In iOS 9, Apple introduced a new security feature called App Transport Security (ATS), which aims to enhance data protection by enforcing secure connections between an app and web services. By default, ATS requires all HTTP connections to be upgraded to HTTPS, which means that any attempts to load non-secure HTTP URLs would result in failure.

However, there are scenarios where an app may need to access an HTTP URL. To allow HTTP communication when ATS is enabled, you have to configure your app’s Info.plist file to include exceptions to the default security policies. Below is a detailed guide explaining how to configure ATS to load HTTP URLs in iOS 9.

How App Transport Security Works

1. Secure Defaults: ATS requires the use of HTTPS connections only.
2. TLS Version: The server must support at least Transport Layer Security (TLS) 1.2.
3. Strong Ciphers: Secure ciphers are necessary to establish a secured connection.
4. Certificate Transparency: Ensures that the server’s certificate is correctly registered.

Configuring App Transport Security

Step 1: Identify the Need

Before proceeding with disabling ATS for specific domains, it's crucial to assess whether it’s absolutely necessary. Using HTTPS is strongly recommended to ensure data security and privacy.

Step 2: Modify the Info.plist File

You can disable ATS or configure exceptions to allow HTTP requests by making specific changes to your app’s Info.plist file. Here's a step-by-step process:

1. Open your Xcode project.
2. Navigate to the 'Info.plist' file.

Step 3: Add ATS Exceptions

To configure ATS exceptions, add the following XML snippet to your Info.plist:

1<key>NSAppTransportSecurity</key>
2<dict>
3    <!-- Global Access (not recommended) -->
4    <key>NSAllowsArbitraryLoads</key>
5    <true/>
6
7    <!-- Specific Domain Exception -->
8    <key>NSExceptionDomains</key>
9    <dict>
10        <key>example.com</key>
11        <dict>
12            <key>NSIncludesSubdomains</key>
13            <true/>
14            <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
15            <true/>
16            <key>NSTemporaryExceptionMinimumTLSVersion</key>
17            <string>TLSv1.0</string>
18        </dict>
19    </dict>
20</dict>

Explanation of Keys

• NSAllowsArbitraryLoads: Allows all HTTP requests globally within the app (not advised unless necessary).
• NSExceptionDomains: Specifies which domains can bypass ATS restrictions.
• NSIncludesSubdomains: Applies the configuration to all the subdomains of the specified domain.
• NSTemporaryExceptionAllowsInsecureHTTPLoads: Allows HTTP requests temporarily for specific domains.
• NSTemporaryExceptionMinimumTLSVersion: Specifies the minimum TLS version required.

Summary Table

Additional Considerations

• Security Best Practices: Always aim to use HTTPS endpoints to protect user data.
• Evaluate Legacy Systems: If connecting to legacy systems, consider upgrading them to support HTTPS.
• Compliance: Ensure that your app complies with Apple's security policies and passes the App Store review.

Conclusion

While it is possible to load HTTP URLs in iOS 9 by configuring exceptions in the Info.plist file, it is imperative from a security standpoint to prioritize secure, HTTPS connections. If exceptions must be made, implement them carefully and restrict them to specific cases or domains only. Following these guidelines will help maintain the integrity and security of your app while accommodating necessary exceptions to ATS settings.