iOS9 does not load insecure resources from a secure page (SSL/HTTPS)

Question

I am trying to load a page into UIWebView on iOS9 using https:// URL. The page loaded includes CSS and images from an insecure server.

E.g. the page loaded: https://www.example.com/ which includes stylesheet http://www.example.com/style.css and image http://www.example.com/image.jpg

Everything works if the original page is loaded via insecure connection (regular http). Everything works also on iOS8 both via HTTPS and HTTP.

I did set NSAppTransportSecurity to NSAllowsArbitraryLoads in application PLIST file:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <true/>
</dict>

Though when loading the page via HTTPS, the images are loaded OK, but CSS files are not. Seems like UIWebView blocks loading insecure resources from a secure page.

Is there any setting of UIWebView that will allow to load CSS via insecure connection?

Answer 1

This is not related to ATS. WebKit enforces a mixed content policy that disallows access to certain classes of "active" content (JS, CSS, etc) from being loaded over an insecure connection when the host page is being served over https.

If you examine your page in the Inspector you will see this being reported in the error panel.

---

Follow up: You can't turn off mixed content blocking. Allowing insecure CSS or JS reduces the security of the entire page to that of the least secure resource. The solution if you must load css/js over http is to load the entire page over http. That way the UI seen by the user correctly reflects the security of the content.

Answer 2

In your info.plist you need to add the following App Transport Security keys:

NSAppTransportSecurity                                      Dictionary
    NSAllowsArbitraryLoads                                  Boolean       YES
    NSExceptionDomains                                      Dictionary    
        **YOUR-DOMAIN-HERE**                                Dictionary
            NSExceptionAllowsInsecureHTTPLoads              Boolean       YES
            NSIncludesSubdomains                            Boolean       YES
            NSThirdPartyExceptionAllowsInsecureHTTPLoads    Boolean       YES

Hopefully this should work for you.

Answer 3

App Transport Security revised in iOS9 release. Now onwards your application is safe from un secure connection. And iOS forces to make secure connection. This can be conflict in your case.

From Apple documentation

If your app needs to make a request to an insecure domain, you have to specify this domain in your app's Info.plist file

So I think this can make an issue while loading .css file for web pages.

So give a try specify your domain in info.plist and check that .css files are loaded or not.

Edit:

---

Spotlight: You need to add more keys here in info.plist.

Look at this key NSThirdPartyExceptionAllowsInsecureHTTPLoads this allows a service domain which is not controlled by developer and add an exception to Transport layer to by pass insecure resources.

The structure for adding keys for App Transport Security is below:

For more details and explanation about all keys check this note - App Transport Security Technote

Answer 4

On Xcode 8.3.3 (8E3004b)

It has changed to

App Transport Security Settings > Allow Arbitrary Loads in Web Content > YES

Answer 5

Below procedure enable me to open not secure content in WKWebView.

1. First I added Allow Arbitrary Loads in Web Content = YES and Allow Arbitrary Loads = YES in App Transport Security Settings dictionary in info.plist.

2. I have added below wkwebview delegate method:

   func webView(_ webView: WKWebView, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) { completionHandler(.useCredential, URLCredential(trust: challenge.protectionSpace.serverTrust!)) }

   For 2nd step don't forget to register delegate as:

   override func viewDidLoad() { super.viewDidLoad() self.webView.navigationDelegate = self }

Answer 6

I use webkit tool but i can't open the link that ssl not allow (some https links) and it's work on swift4 by this code (you must declare delegate before)

override func viewDidLoad() {
    super.viewDidLoad()

    let url = URL(string: currentAttach.fileUrl!)
    let req = URLRequest(url:url!)
    self.webView!.load(req)
    self.webView.navigationDelegate = self

    }
}

extension ViewController: WKNavigationDelegate{

    //MARK:- WKNavigationDelegate
    //For Allow SSL https
    func webView(_ webView: WKWebView, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        completionHandler(.useCredential, URLCredential(trust: challenge.protectionSpace.serverTrust!))
    }

    func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) {
        print(error.localizedDescription)
    }

    func webView(_ webView: WKWebView, didStartProvisionalNavigation navigation: WKNavigation!) {
        print("Strat to load")
        startLoading()
    }

    func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
        print("finish to load")
        stopLoading()
    }

}