NSExceptionAllowsInsecureHTTPLoads not working for IP addresses

Question

excluding ATS on iOS 9 doesn\'t work for me.

I have a test server which has no domain name (IP address only) and no SSL certificate (so it is HTTP and not HTTPS)

Answer 1

Actually, the real problem is that in iOS 9, ATS exceptions do not work with IP addresses. It only works with domain names. Turning off ATS altogether is a bad idea, and will cause you to justify that decision if you wish to submit to the app store after 12/31/2016.

Unfortunately, there is not a great solution to this short of trying to get a domain name for the server you are trying to connect to.

Others have had success using xip.io service to "convert" the local IP address to a domain name. So you would add xip.io to the Exception domains, set the subvalue for NSIncludesSubdomains to true. Then when you connect to your domain, instead of connecting to 52.24.145.252 you would connect to 52.24.145.252.xip.io

Answer 2

Try this:

Or, as source code:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>domain.com</key>
        <dict>
            <key>NSExceptionAllowsInsecureHTTPLoads</key>
            <true/>
            <key>NSIncludesSubdomains</key>
            <true/>
        </dict>
    </dict>
</dict>

Like that it works (given your domain is correct) in iOS 9.1.

Answer 3

You need to add NSAppTransportSecurity dictionary to your info.plist. Then add NSAllowsArbitraryLoads key to that dictionary and set the boolean value to YES.

Update

From 2017 January, if you are using the above mentioned method for opting-out from ATS you need to provide a justification to Apple while submitting your app to AppStore.

App Transport Security REQUIRED January 2017