Search code examples
iosxcodeswifthttp-postapp-transport-security

IOS 9 Sending Post Request, Blocked by ATS, Bypass is not working


I'm trying to bypass Application Transport Security(ATS), its a new feature of IOS 9 and Xcode 7. However, I tried the info.plist bypass and I am still having problems. I tried the exact same code in Xcode 6 and the request does get sent successfully, so the request should be correct. This could just be a bug on the new Xcode but I was wondering if anyone else ran into the same issue. I'm pretty sure I'm following proper documentation: https://developer.apple.com/library/prerelease/ios/technotes/App-Transport-Security-Technote/index.html#//apple_ref/doc/uid/TP40016240

Info.plist(not complete, just part on ATS)

    <key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict/>
    <key>NSAllowsArbitraryLoads</key>
    <true/>
    <key>http://127.0.0.1:5000</key>
    <dict>
        <key>NSIncludesSubdomains</key>
        <true/>
        <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
        <true/>
        <key>NSTemporaryExceptionMinimumTLSVersion</key>
        <string>TLSv1.1</string>
    </dict>
</dict>

Request:

    let postData = NSMutableData(data: "username=bobbyz".dataUsingEncoding(NSUTF8StringEncoding)!)
    postData.appendData("&password=form".dataUsingEncoding(NSUTF8StringEncoding)!)

    let request = NSMutableURLRequest(URL: NSURL(string: "http://127.0.0.1:5000/register")!,
        cachePolicy: .UseProtocolCachePolicy,
        timeoutInterval: 10.0)
    request.HTTPMethod = "POST"
    request.HTTPBody = postData

    let session = NSURLSession.sharedSession()
    let dataTask = session.dataTaskWithRequest(request, completionHandler: { (data, response, error) -> Void in
        if (error != nil) {
            print(error)
        } else {
            let httpResponse = response as? NSHTTPURLResponse
            print(httpResponse)
        }
    })

    dataTask.resume()

Solution

  • This just happened to me. Turns out I accidentally added the bypass information to my Unit Test Info.plist. Putting it in the correct Info.plist fixed the issue, as expected. I also used "localhost" instead of "127.0.0.1" and did not provide the port.

    Using Xcode 7 Beta 4.