It's not necessarily a vulnerability. The purpose of ATS is to get people thinking about implementing SSL. Potentially Apple could make this mandatory in the future but you'll have plenty of notice.
Sent from my iThing > On 16 Oct 2015, at 08:14, Devarshi Kulshreshtha <devarshi.bluec...@gmail.com> > wrote: > > What happens if you only use this: > >> >> <key>NSAllowsArbitraryLoads</key> >> <true/> >> >> ?? > > Then it works as expected.. but that is not the preferred approach .. > because we are pointing to local ip just for testing purpose, in future we > will be pointing it to a public IP (probably https) and if we miss to > update the info.plist then it will be security vulnerability.. right? > > >> >>> On Oct 15, 2015, at 3:56 PM, Marek Hrušovský wrote: >>> >>> I read on some blogposts that ios9 GM did not support IP addresses for >> ATS. >>> Do not know if this has changed. >>> >>> On Thu, Oct 15, 2015 at 9:06 PM, Devarshi Kulshreshtha < >>> devarshi.bluec...@gmail.com> wrote: >>> >>>> Our webservices are hosted in some local IP, to bypass the App Transport >>>> Security I added this as dictionary for NSAppTransportSecurity key in my >>>> info.plist file: >>>> >>>> >>>> <dict> >>>> <key>NSAllowsArbitraryLoads</key> >>>> <false/> >>>> <key>NSExceptionDomains</key> >>>> <dict> >>>> <key>localhost</key> >>>> <dict> >>>> <key>NSExceptionAllowsInsecureHTTPLoads</key> >>>> <true/> >>>> </dict> >>>> <key>10.32.27.12</key> >>>> <dict> >>>> <key>NSExceptionAllowsInsecureHTTPLoads</key> >>>> <true/> >>>> </dict> >>>> </dict> >>>> </dict> >>>> >>>> but for some reasons I am still getting this error message: >>>> >>>> App Transport Security has blocked a cleartext HTTP (http://) resource >>>> load >>>> since it is insecure. Temporary exceptions can be configured via your >> app's >>>> Info.plist file >>>> >>>> Any ideas? >>>> >>>> -- >>>> Thanks, >>>> >>>> Devarshi >>>> _______________________________________________ >>>> >>>> Cocoa-dev mailing list (Cocoa-dev@lists.apple.com) >>>> >>>> Please do not post admin requests or moderator comments to the list. >>>> Contact the moderators at cocoa-dev-admins(at)lists.apple.com >>>> >>>> Help/Unsubscribe/Update your Subscription: >>>> https://lists.apple.com/mailman/options/cocoa-dev/xhruso00%40gmail.com >>>> >>>> This email sent to xhrus...@gmail.com >>> _______________________________________________ >>> >>> Cocoa-dev mailing list (Cocoa-dev@lists.apple.com) >>> >>> Please do not post admin requests or moderator comments to the list. >>> Contact the moderators at cocoa-dev-admins(at)lists.apple.com >>> >>> Help/Unsubscribe/Update your Subscription: >>> https://lists.apple.com/mailman/options/cocoa-dev/zav%40mac.com >>> >>> This email sent to z...@mac.com > > > -- > Thanks, > > Devarshi > _______________________________________________ > > Cocoa-dev mailing list (Cocoa-dev@lists.apple.com) > > Please do not post admin requests or moderator comments to the list. > Contact the moderators at cocoa-dev-admins(at)lists.apple.com > > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/cocoa-dev/jamie%40consolegfx.net > > This email sent to ja...@consolegfx.net _______________________________________________ Cocoa-dev mailing list (Cocoa-dev@lists.apple.com) Please do not post admin requests or moderator comments to the list. Contact the moderators at cocoa-dev-admins(at)lists.apple.com Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/cocoa-dev/archive%40mail-archive.com This email sent to arch...@mail-archive.com
