Geek Answers Handbook

Is it safe to add localhost to App Transport Security (ATS) NSExceptionDomains?

Is it safe from a security point of view to add localhost to ATS NSExceptionDomains for development use? It is not very convenient (and easy to forget) to delete these lines from the Info.plist file before each commit.

 <dict> <key>NSExceptionDomains</key> <dict> <key>localhost</key> <dict> <key>NSIncludesSubdomains</key> <true/> <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key> <true/> </dict> </dict> </dict>

In addition, Apple may abandon the application because of this?

+7
ios iphone app-transport-security
source share
2 answers

Now you can do this for local addresses:

 <key>NSAppTransportSecurity</key> <dict> <key>NSAllowsLocalNetworking</key> <true/> </dict>

Apple blessed this key as an exception to ATS - he said that he would not reject applications for its use. More details here: https://developer.apple.com/library/content/documentation/General/Reference/InfoPlistKeyReference/Articles/CocoaKeys.html (page search for "local")

+28
source share

If this is not required in the production version of the application, I would set your build configurations to use two different Info.plist files. Basically, you can create your internal version of plist as "Internal-Info.plist" and throw a local exception. Then create "Info.plist" for a production that does not have this exception, which gives Apple no reason to reject your application now or in the future.

To configure your assemblies to automatically enter the right Info.plist for the assembly type:

  • Select your project from the left navigator
  • Select the goal you want to change (in the "GOALS" section)
  • Click Build Settings
  • Search "Info.plist"
  • In the "Packaging" section, you will see the "Info.plist file" option. Select the line, then click the small triangle to expand it so you can have different settings for different build configurations. Change the value of "Debug" to "Internal-Info.plist"

Make sure you copy "Info.plist" to the new file "Internal-Info.plist", remove the exception from "Info.plist", and you should be good.

Apple may reject you now for this (only Apple knows), but starting in 2017 Apple will require a valid reason for ATS exceptions, so if you do not have a valid justification for excluding ATS requirements for the local host, the best way is to configure it correctly.

+2
source share

More articles:


All Articles