Skip to content
Narvy

NSAllowsArbitraryLoads: App Transport Security disabled for every domain

NSAllowsArbitraryLoads = YES turns App Transport Security off for every domain, so App Review asks you to justify it. Serve your endpoints over HTTPS and, for the hosts that cannot, add an exception per domain in NSExceptionDomains instead.

Xcode console, at runtimeNSURLErrorDomain -1022
Error Domain=NSURLErrorDomain Code=-1022 "The resource could not be loaded because the App Transport Security policy requires the use of a secure connection."
Xcode console, at runtime
App Transport Security has blocked a cleartext HTTP (http://) resource load since it is insecure. Temporary exceptions can be configured via your app's Info.plist file.

What it means

You must supply a justification during App Store review if you set the key's value to YES, as described in Provide Justification for Exceptions.

Apple, NSAllowsArbitraryLoads

App Transport Security makes URL loading require HTTPS with modern TLS. The errors above are what an app sees when ATS blocks a plain http:// request; turning ATS off globally hides them but drops the protection for every host. On iOS 10 and later, NSAllowsArbitraryLoads is ignored when NSAllowsArbitraryLoadsForMedia, NSAllowsArbitraryLoadsInWebContent or NSAllowsLocalNetworking is present; the store check accounts for that.

Deadline

No date: there is no upload error for ATS. The question comes up at App Review.

How to fix it

1. Move endpoints to HTTPS

Including image CDNs, analytics and ad SDK endpoints, which are the usual reason the key was added.

2. Replace the global switch with per-domain exceptions

Info.plist
<key>NSAppTransportSecurity</key>
<dict>
  <key>NSExceptionDomains</key>
  <dict>
    <key>legacy.example.com</key>
    <dict>
      <key>NSExceptionAllowsInsecureHTTPLoads</key>
      <true/>
    </dict>
  </dict>
</dict>

For content loaded in a web view only, NSAllowsArbitraryLoadsInWebContent is narrower than the global switch.

Check before you submit

Upload the IPA on the store check page. It runs APPSTORE-ATS against the dates on this page, then deletes the file: nothing about the app is kept. The same engine runs offline in the Narvy CLI, and exits with code 1 when a blocker is found, so it can gate a CI job.

Offline, from a terminal (narvy-cli 1.2.0 or later)
narvy store-check MyApp.ipa

Check a build in the browser

FAQ

Will Apple reject the app because of NSAllowsArbitraryLoads?

Apple's documentation requires a justification during review when the value is YES. Whether a given justification is accepted is App Review's decision, which is why the store check reports a warning, not a blocker.

Why is my app flagged for per-domain exceptions?

It is not a failure: exceptions with NSExceptionAllowsInsecureHTTPLoads are listed as info so you can confirm each host still needs plain HTTP.