Overview

Since iOS 9 App Transport Security (ATS) blocks cleartext HTTP traffic by default for connections using the URL Loading System (typically via URLSession). However, an app can still send cleartext traffic through several ATS exceptions configured in the Info.plist file under the NSAppTransportSecurity key.

The following configurations allow cleartext traffic:

For more information on ATS configuration, see MASTG-KNOW-0071.

Limitations

ATS only applies to connections made via the URL Loading System. Lower-level APIs such as the Network framework or CFNetwork are not affected by ATS settings and may still allow cleartext traffic regardless of the configuration. See MASTG-TEST-0323 for more details.

Steps

  1. Use MASTG-TECH-0058 to unzip the app package.
  2. Use MASTG-TECH-0153 to retrieve the Info.plist file.
  3. Use MASTG-TECH-0155 to analyze the ATS configuration for cleartext traffic exceptions.

Observation

The output should contain the ATS configuration, if present, including any exceptions that allow cleartext traffic.

Evaluation

The test case fails if cleartext traffic is permitted. This can happen if any of the following conditions are met:

  1. NSAllowsArbitraryLoads = true only when none of the fine-grained keys (2-4 below) are present (because on iOS 10+ they cause NSAllowsArbitraryLoads to be ignored).
  2. NSAllowsArbitraryLoadsInWebContent = true.
  3. NSAllowsArbitraryLoadsForMedia = true.
  4. NSAllowsLocalNetworking = true.
  5. Any domain under NSExceptionDomains sets NSExceptionAllowsInsecureHTTPLoads = true.

Further Validation Required:

Inspect the identified ATS exceptions to determine whether they are justified for the app's intended purpose: