App Transport Security (ATS)

Networking Mid-level Swift 5.0+ iOS 15+ Reviewed By Alok Singh

Pick the fix

One partner API host still serves plain HTTP. What do you do?

Options
Hint 1 of 1

How narrow can the exception be?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A Add an NSExceptionDomains entry for that host only, with NSExceptionAllowsInsecureHTTPLoads, and plan its removal

Correct. The rest of the app keeps full ATS protection.

Why not the others?
  • B Set NSAllowsArbitraryLoads to true. That turns ATS off everywhere and needs App Review justification.
  • C Switch to a third-party HTTP library. It doesn't make the connection secure.
  • D Replace http with https in the URL and ignore errors. If the host has no valid TLS, requests simply fail.

30-second answer

ATS makes apps use HTTPS with TLS 1.2 or later and strong ciphers for connections made through URLSession. If one legacy host can't comply, add an exception for that domain only under NSExceptionDomains in Info.plist, and plan to remove it. Turning ATS off globally with NSAllowsArbitraryLoads needs a justification in App Review and exposes all traffic.

Practise saying it · 30 s. No recording, just a timer

Explain ATS and exceptions.

Say your answer out loud, then check which of these points you covered:

  • HTTPS + TLS 1.2
  • Narrow per-domain exceptions
  • Avoid arbitrary loads

Deep dive

NSAllowsLocalNetworking permits local development servers.

Exceptions should be as narrow as possible: one domain and one setting.

ATS doesn't replace certificate pinning for high-security apps.

Web content in WKWebView has its own ATS key.

Common mistakes

  • Disabling ATS globally to fix one host.
  • Leaving development exceptions in release builds.

Senior take & follow-ups

Seniors keep exceptions narrow and documented, with a removal plan.

Follow-up questions

Think of your answer first, then open the hint.

  1. What does ATS require?

    Show hint

    HTTPS, TLS 1.2+, forward secrecy.

  2. How do you allow a local dev server?

    Show hint

    NSAllowsLocalNetworking.

Related questions

Suggest a fix if something here is wrong or out of date.