Other Apple restrictions on non-ssl http requests

[Erel]

Important to read this Apple announcement: https://techcrunch.com/2016/06/14/a...-connections-for-ios-apps-by-the-end-of-2016/

ATS is disabled by default in B4i. You can change it with the #ATSEnabled property. The default value will probably be changed in the future.

It is not clear whether Apple will allow to use exceptions as described here: http://stackoverflow.com/questions/...-with-app-transport-security-enabled-in-ios-9

My guess that they will allow such exceptions.

 

[Pendrush]

As as first reply on https://forums.developer.apple.com/message/153123#153123 (escimo reply)

If you’re using SFSafariViewController, you shouldn’t need any ATS exceptions; SFSafariViewController acts just like Safari with regards ATS.

Can we use SFSafariViewController somehow in our apps?

 

[Erel]

If I understand correctly you can use WKWebView (iUI8 library) with NSAllowsArbitraryLoadsInWebContent. SFSafariViewController will also be available in the future. It is a simple control

 

[Pendrush]

My app must use http somehow. As ATS get mandatory in few months I need to find a way.
Can anyone provide example of using NSAllowsArbitraryLoadsInWebContent?

 

[Pendrush]

I have tried different option but without any progress

#Region  Project Attributes
    #ApplicationLabel: WKWebView Test
    #Version: 1.0.0
    #iPhoneOrientations: Portrait
    #iPadOrientations: Portrait
    #Target: iPhone, iPad
    #MinVersion: 8
    #ATSEnabled: True
    #PlistExtra:<key>NSAllowsArbitraryLoadsInWebContent</key><true/> 
#End Region

Sub Process_Globals

    Public App As Application
    Public NavControl As NavigationController
    Private Page1 As Page
    Private wWeb As WKWebView

End Sub

Private Sub Application_Start (Nav As NavigationController)

    NavControl = Nav
    Page1.Initialize("Page1")
    Page1.Title = "Page 1"
    Page1.RootPanel.LoadLayout("p1")
    NavControl.ShowPage(Page1)
   
    wWeb.LoadUrl("http://mashable.com/")

End Sub

Private Sub Page1_Resize(Width As Int, Height As Int)
End Sub

Private Sub Application_Background
End Sub

Page refuse to load into WKWebView

EDIT:
Right code will be something like

#PlistExtra:<key>NSAppTransportSecurity</key><dict><key>NSAllowsArbitraryLoadsInWebContent</key><true/></dict>

but as I can see, this will only work on iOS10.
https://developer.apple.com/library...InfoPlistKeyReference/Articles/CocoaKeys.html

The NSAppTransportSecurity key is supported in iOS 9.0 and later and in OS X v10.11 and later, and is available in app extensions. The NSAllowsArbitraryLoadsInWebContent and NSRequiresCertificateTransparency subkeys are supported in iOS 10.0 and later and in OS X v10.12 and later.

I'm running iOS 9.3.3 so this will not work in my configuration.
If anyone have iOS 10 beta installed, maybe can test if this work or not.

 

[Erel]

I will test it tomorrow.

 

[Pendrush]

I have updated my iPad to iOS 10 Beta.
This code actually work.

#Region  Project Attributes
    #ApplicationLabel: WKWebView Test
    #Version: 1.0.0
    #iPhoneOrientations: Portrait
    #iPadOrientations: Portrait
    #Target: iPhone, iPad
    #MinVersion: 8
    #ATSEnabled: True
    #PlistExtra:<key>NSAppTransportSecurity</key><dict><key>NSAllowsArbitraryLoadsInWebContent</key><true/></dict> 
#End Region

Sub Process_Globals
   
    Public App As Application
    Public NavControl As NavigationController
    Private Page1 As Page
    Private wWeb As WKWebView
   
End Sub

Private Sub Application_Start (Nav As NavigationController)
   
    NavControl = Nav
    Page1.Initialize("Page1")
    Page1.Title = "Page 1"
    Page1.RootPanel.LoadLayout("p1")
    NavControl.ShowPage(Page1)
       
    wWeb.LoadUrl("http://mashable.com/")
   
End Sub

Private Sub Page1_Resize(Width As Int, Height As Int)
End Sub

Private Sub Application_Background
End Sub

This code only work on iOS 10, question is what we can do for iOS 9 and iOS 8.

 

[Erel]

Apple will not reject your app automatically if you explain why you need to allow non-ssl requests.

 

[Pendrush]

I have read Apple developers forum for 4-5 hours, no one know exactly how will they do application review and what will happen with "old" app where ATS is turned off.
For now my apps are on app store without ATS enabled, but after end of December 2016, as ATS become mandatory for all apps, I don't think they will allow any application without ATS enabled (as I read today on Apple forum).
I have already switched my domains on HTTPS, but some third party services (web APIs) are out of my control.
So I need to know every possible options and solutions, before it's get to late.

 

[JanPRO]

Hi,
do we have to switch our Apps also to Https when they already in the store? Or does this effect only new apps?

Jan

 

[Erel]

They haven't yet provided all the details. However it will be surprising if they break existing apps.

 

[fabton1963]

Hi,
if I enable #ATSEnabled: True in my ipad ios 9.3.5 the HttpJob object return SSL error.
In my server I'm using Let's encrypt certificates.

 

[tufanv]

Hi,
if I enable #ATSEnabled: True in my ipad ios 9.3.5 the HttpJob object return SSL error.
In my server I'm using Let's encrypt certificates.

if it is a self signed ssl it may be the problem. My serer also return error. I need to buy a ssl certificate according to server admins.

 

[Erel]

Tutorial about ATS: https://www.b4x.com/android/forum/threads/ats-app-transport-security.74281/

You can add an exclusion for your server url.

For further discussion please start a new thread.