App Transport Security (ATS) is Apple's default networking policy for iOS, iPadOS, and macOS apps: by default, it requires TLS 1.2 or later, forward-secrecy-capable cipher suites, and a certificate signed with sufficiently strong keys and hashes for essentially all network connections your app makes. If a server you connect to doesn't meet that bar, the connection fails outright rather than falling back to something weaker — which is the whole point, but it does mean you sometimes need to declare an explicit, scoped exception rather than fight the default.
Where exceptions are configured
ATS settings live in your app's Info.plist under the NSAppTransportSecurity dictionary key. Two very different things live under that same key, and conflating them is the most common mistake:
- NSAllowsArbitraryLoads — a blanket, app-wide opt-out of ATS entirely. This disables the protection for every connection your app makes, to every domain, with no exceptions. Apple's App Review has scrutinized apps using this setting for years, and a submission using it without a clearly justified, narrow reason is a common source of rejection or extra review scrutiny.
- NSExceptionDomains — a dictionary of specific domains, each with its own specific relaxed rules (allow plain HTTP for this one domain, lower the minimum TLS version for that one, etc.), leaving ATS's default protection fully intact for every other domain your app talks to.
Per-domain exceptions under NSExceptionDomains are almost always the right tool, even when the underlying reason feels like it applies "everywhere" — it's rare that an app genuinely needs to relax TLS requirements for every server it will ever talk to, versus one specific legacy API or third-party SDK endpoint.
Common per-domain exception keys
NSExceptionAllowsInsecureHTTPLoads— allows plain HTTP (no TLS at all) to that specific domain.NSExceptionMinimumTLSVersion— lowers the minimum TLS version accepted for that domain, for a server that hasn't been updated past TLS 1.0/1.1.NSIncludesSubdomains— extends the exception to subdomains of the listed domain rather than just the exact hostname.NSExceptionRequiresForwardSecrecy— set to false only if the server's cipher suite selection genuinely doesn't support forward secrecy, which is uncommon on any reasonably current server.
NSAllowsLocalNetworking, for local development
If your app needs to reach a device on the local network during development or for a legitimate local-device-communication feature (an IoT companion app, for instance), NSAllowsLocalNetworking relaxes ATS specifically for local-network addresses without weakening anything for the public internet — a meaningfully different, narrower exception than either of the two above.
The right fix, in order of preference
Before reaching for any exception, the actually-correct fix is almost always upgrading the server's own TLS configuration to meet ATS's defaults — the same modern configuration (TLS 1.2+, forward-secret cipher suites, a properly chained certificate) that any other current client would also expect. Exceptions exist for cases genuinely outside your control: a third-party API you don't operate and can't influence, or legacy infrastructure with a defined, time-boxed upgrade plan. Treat an ATS exception as a documented, temporary accommodation rather than a permanent fixture of your app's configuration.
Loading comments…