Cleartext HTTP blocked

Question

After updating to the new released Xcode 7 version I faced this issue .

App Transport Security has blocked a cleartext HTTP (http://) resource load since it is insecure. Temporary exceptions can be configured via your app's Info.plist file. gete The resource could not be loaded because the App Transport Security policy requires the use of a secure connection.

I did some search and I found solutions that said to add these lines to the info.plist file in my project ,but the issue did not solved

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>CFBundleDevelopmentRegion</key>
    <string>en</string>
    <key>CFBundleExecutable</key>
    <string>$(EXECUTABLE_NAME)</string>
    <key>CFBundleIdentifier</key>
    <string>com.thenewsapp.$(PRODUCT_NAME:rfc1034identifier)</string>
    <key>CFBundleInfoDictionaryVersion</key>
    <string>6.0</string>
    <key>CFBundleName</key>
    <string>$(PRODUCT_NAME)</string>
    <key>CFBundlePackageType</key>
    <string>BNDL</string>
    <key>CFBundleShortVersionString</key>
    <string>1.0</string>
    <key>CFBundleSignature</key>
    <string>????</string>
    <key>CFBundleVersion</key>
    <string>1</string>
    <key>NSAppTransportSecurity</key>
<dict>
      <key>NSAllowsArbitraryLoads</key>
      <true/>
       <key>NSExceptionDomains</key>
       <dict>
            <key>greenarea.com</key>
            <dict>
                <key>NSIncludesSubdomains</key>
                <true/>
                <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
                <true/>
                <key>NSTemporaryExceptionMinimumTLSVersion</key>
                <string>TLSv1.1</string>
            </dict>
       </dict>
</dict>
</dict>
</plist>

any help

Why did you not set NSAllowsArbitraryLoads to true? That would let you make all the HTTP calls. — dispatchMain
Well, that seems weird. I just checked it and its working. Could please show us your info.plist? To make sure, You need to add NSAppTransportSecurity as a dictionary and inside that NSAllowsArbitraryLoads as a boolean and set it to YES. — dispatchMain
Could you remove everything after NSAllowsArbitraryLoads inside NSAppTransportSecurity dictionary and try once? — dispatchMain

Rajat Rajat · Accepted Answer · 2015-09-18T16:54:43

Mentioned here

App Transport Security (ATS) enforces best practices in the secure connections between an app and its back end. ATS prevents accidental disclosure, provides secure default behavior, and is easy to adopt; it is also on by default in iOS 9 and OS X v10.11. You should adopt ATS as soon as possible, regardless of whether you’re creating a new app or updating an existing one.

If you’re developing a new app, you should use HTTPS exclusively. If you have an existing app, you should use HTTPS as much as you can right now, and create a plan for migrating the rest of your app as soon as possible. In addition, your communication through higher-level APIs needs to be encrypted using TLS version 1.2 with forward secrecy. If you try to make a connection that doesn't follow this requirement, an error is thrown. If your app needs to make a request to an insecure domain, you have to specify this domain in your app's Info.plist file.

It is clearly mentioned that you will go for https protocol from http, till then this is the workaround

Also apart from NSAllowsArbitraryLoads in your plist, remove all the remaining key from NSAppTransportSecurity dict

Cleartext HTTP blocked

1 Answers