Overview

App Transport Security (ATS) only applies to connections made via the URL Loading System (typically URLSession). Lower-level networking APIs bypass ATS entirely, meaning they can establish cleartext HTTP connections regardless of the app's ATS configuration.

The following low-level APIs are not affected by ATS:

Apple recommends preferring high-level frameworks: "ATS doesn't apply to calls your app makes to lower-level networking interfaces like the Network framework or CFNetwork. In these cases, you take responsibility for ensuring the security of the connection. You can construct a secure connection this way, but mistakes are both easy to make and costly. It's typically safest to rely on the URL Loading System instead."

For more information on when ATS applies, see MASTG-KNOW-0071.

Steps

  1. Use MASTG-TECH-0058 to extract the relevant binaries from app package.
  2. Use MASTG-TECH-0066 to look for the relevant APIs in the app binaries.

Observation

The output should contain a list of low-level networking API usages and their locations within the app binary.

Evaluation

The test case fails if the app uses low-level networking APIs to establish cleartext connections.

Further Validation Required:

Inspect each reported code location using MASTG-TECH-0076 to determine whether cleartext connections are established: