I am developing an enterprise application. So far every thing was working fine in simulator but when i deploy it on physical devices it crashes. Crash is happening because app is connecting to web services via "HTTP" instead of "HTTPS".
I have added the ATS exceptions in
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
Any Apple App Store Submissions starting 2017, still can request a App Transport Security (ATS) exception that will be reviewed by Apple. You will need to highly restrict your exception list and not allowed blanket arbitrary http loads. The reviewers can still reject your submission and request additional information.
i.e. Apps requesting US Government NOAA Images over a non-secure channel might to allowed since NOAA currently does not support HTTPS/SSL for those weather radar images.... Again, up to the Apple reviewers...
NSAllowsArbitraryLoadsInWebContentlets you have a strict ATS dictionary but still load arbitrary content in a web view (WKWebView, UIWebView, WebView)
NSAllowsLocalNetworkingallows loading of local resources without disabling ATS for the rest of your app
NSAllowsArbitraryLoadsInMediadisables all ATS restrictions for media that your app loads using the AV Foundation framework. Employ this key only for loading media that are already encrypted, such as files protected by FairPlay or by secure HLS, and that do not contain personalized information.
These do not get Apple reviewed, thus disabling ATS is allowed until a possible future version of iOS that would disallow non-secure traffic, but that is far from a best practice
If your Enterprise app requires non-secure local network-based resources, use the new
NSAllowsLocalNetworking exception instead.
If your Enterprise app requires non-secure Enterprise resources obtained over the public internet, you might have security issues that are beyond the scope of just iOS App Transport Security issues.