App Transport Security breaks Web View

Question

My app which works great under iOS8 no longer runs under iOS9. The problem is that despite having the following in my .plist file:

<key>NSAppTransportSecurity</key>
<dict>
   <!--Include to allow all connections (DANGER)-->
   <key>NSAllowsArbitraryLoads</key>
   <true/>
</dict>

The following code:

NSURL *targetURL = [NSURL URLWithString:_caseStudyListTitleURL];
NSURLRequest *request = [NSURLRequest requestWithURL:targetURL];
[_myWebView loadRequest:request];

results in the error:
NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9813)

This of course leads to an empty webView being displayed.

All other NSURLSession Code in the app is functioning correctly.

I am running XCode 7 Beta 3 and iOS 9 on my test iPad.

Any ideas on this would be greatly appreciated!

Did you sort this out? Was the target URL using HTTP or HTTPS? Can you repro this with a URL you can share publicly? — Ben Flynn, Sep 09 '15 at 06:03

score 2 · Answer 1 · answered Aug 06 '15 at 07:22

Try this solution:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>yourdomain.com</key>
        <dict>
            <key>NSIncludesSubdomains</key>
            <true/>
            <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
            <true/>
            <key>NSTemporaryExceptionMinimumTLSVersion</key>
            <string>TLSv1.1</string>
        </dict>
    </dict>
</dict>

score 0 · Answer 2 · edited May 23 '17 at 12:32

It is happening because you're using a self-signed certificate, it's necessary to add some additional code. Because by default iOS will reject all untrusted https connections.

Restricting untrusted connections is very good default behaviour and any disabling of this is highly risky.

Use this method to bypass authentication challenge:

-(void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge{

//code to cancel authentication challenge

}

In case you don't know how to use it to cancel authentication challenge then you can find some great help from this article regarding loading HTTPS url in WebView.

Also have a look at this answer as well.

App Transport Security breaks Web View

2 Answers2

Linked