App Transport Security has blocked - ios

Question

I am creating an application for ios by using Swift. My Xcode version 7.0.1. Basically i want to display some web pages in UIWebView and social media integration (Facebook) and displaying one FaceBook page. I use the following items in Info.plist file.

<key>NSAppTransportSecurity</key>
        <dict>
            <!--Include to allow all connections (DANGER)-->
            <key>NSAllowsArbitraryLoads</key>
            <true/>
            <key>NSExceptionDomains</key>
            <dict>
                <key>facebook.com</key>
                <dict>
                    <key>NSIncludesSubdomains</key> <true/>
                    <key>NSThirdPartyExceptionRequiresForwardSecrecy</key> <false/>
                </dict>
                <key>fbcdn.net</key>
                <dict>
                    <key>NSIncludesSubdomains</key> <true/>
                    <key>NSThirdPartyExceptionRequiresForwardSecrecy</key>  <false/>
                </dict>
                <key>akamaihd.net</key>
                <dict>
                    <key>NSIncludesSubdomains</key> <true/>
                    <key>NSThirdPartyExceptionRequiresForwardSecrecy</key> <false/>
                </dict>
            </dict>
        </dict>

Now FaceBook share (integration) working. Displaying web pages working but displaying Facebook page is not working. It showing empty. And I am facing following error:

App Transport Security has blocked a cleartext HTTP (http://) resource load since it is insecure. Temporary exceptions can be configured via your app's Info.plist file.

Initially I have this issue for every single webview. I search this error in Google then i found I need to add above code in my .plist file. I done that after that other pages working FaceBook page not working.

Note: I am reading Facebook link from Localizable.strings file like this.

 var url = NSLocalizedString("facebook_link", comment: "");
let requestURL = NSURL(string:url)
        let request = NSURLRequest(URL: requestURL!)
        webView.loadRequest(request)

check this..http://stackoverflow.com/questions/31254725/transport-security-has-blocked-a-cleartext-http/32560433#32560433 — Bhavin Bhadani, Oct 16 '15 at 06:46
I have this. NSAllowsArbitraryLoads . Is that not enough? I am very new to ios. Sorry if my question is wrong — Amsheer, Oct 16 '15 at 06:48

Anbu.Karthik · Answer 1 · 2015-10-16T06:59:35.550

2

if you want to disable ATS you can use this :

<key>NSAppTransportSecurity</key>  
 <dict>  
      <key>NSAllowsArbitraryLoads</key><true/>  
 </dict>

But this is not recommended at all. The server should have the SSL certificates and so that there is no privacy leaks.

You have to add just the NSAllowsArbitraryLoads key to YES in NSAppTransportSecurity dictionary in your info.plist file.

For example,

 <key>NSAppTransportSecurity</key>
 <dict>
      <key>NSAllowsArbitraryLoads</key>
     <true/>
 </dict>

edited Oct 16 '15 at 06:59

answered Oct 16 '15 at 06:46

Anbu.Karthik

82,064
23
174
143

I have this. NSAllowsArbitraryLoads . Is that not enough? I am very new to ios. Sorry if my question is wrong – Amsheer Oct 16 '15 at 06:47
Ya that is enough, it load all HTTP over HTTPS you are opening up your user's device(s) to vulnerabilities – Anbu.Karthik Oct 16 '15 at 06:49
Already i add this in my .plist file. Please check my question. – Amsheer Oct 16 '15 at 06:51
if you use this NSAllowsArbitraryLoads no need to check NSExceptionDomains, for example check the reference link – Anbu.Karthik Oct 16 '15 at 06:53
Thanks. My .plist file already like this. That is not the issue. I added my answer. I don't know what is wrong. – Amsheer Oct 16 '15 at 07:02
@ha ha ha , any way have a nice day my friend, check once before post your question, if my answer is not worthable , i delete my answer – Anbu.Karthik Oct 16 '15 at 07:04
Your answer is perfectly right. But that is not my issue. I already done the same that you mention in your question. – Amsheer Oct 16 '15 at 07:08

score 0 · Accepted Answer · answered Oct 16 '15 at 07:01

0

I found solution what i am doing is first i try to fetch link from Localizable.strings

Which is not working. But once i change my code slightly it is working

var url = "my facebook link"//NSLocalizedString("facebook_link", comment: "");
let requestURL = NSURL(string:url)
        let request = NSURLRequest(URL: requestURL!)
        webView.loadRequest(request)

I don't know what is happening. But issue fixed.

answered Oct 16 '15 at 07:01

Amsheer

7,046
8
47
81

Which means that your problem is *completely unrelated* to App Transport Security. The real problem is that `NSLocalizedString("facebook_link", comment: "")` does not return what you think it does. – Martin R Oct 16 '15 at 07:07
I also think the same but it showing error like that. I am completely ew to ios don't know much about this. – Amsheer Oct 16 '15 at 07:10
1

You should at least update your question with the relevant information: What entry do you have in Localizable.strings for the "facebook_link" key, and what is the return value from NSLocalizedString(). Without that information, nobody can understand or answer your question, and this Q&A is worthless for future readers. – Martin R Oct 16 '15 at 07:11
You mean you are not seeing this in my question? Note: I am reading Facebook link from Localizable.strings file like this. var url = NSLocalizedString("facebook_link", comment: ""); let requestURL = NSURL(string:url) let request = NSURLRequest(URL: requestURL!) webView.loadRequest(request) – Amsheer Oct 16 '15 at 07:31
I can see that you read the link from Localizable.strings . But I cannot see what the Localizable.strings file contains, and I cannot see what NSLocalizedString() returns, i.e. what actual string is assigned to the url variable. – Martin R Oct 16 '15 at 07:46
Ok that is fine. But the problem is i am not allow to post my link in SO. That is the reason i didn't post. I hope you understand. If that is the mistake sorry. – Amsheer Oct 16 '15 at 08:47

App Transport Security has blocked - ios

2 Answers2