App Transport Security if I Don’t Know All the Insecure Domains I Need to Use

Question

I have seen this question somewhat answered here but in my case I am using NSURLSession to display images. These images are uploaded by user or scanned into a database using a script.

In this case writing exception URL's (NSExceptionDomains) won't work because the image is hosted by a user on their site or some other site. If I allow NSAllowsArbitraryLoads will I still be able to be approve for App Store since I am not implementing the best practices of ATS?

I am not sure the best way to proceed. Any input would be appreciated!

Here is the code I am using.

    NSString *thumbnail_url = [tempObject objectForKey:@"image"];
    NSURL  *url = [NSURL URLWithString:thumbnail_url];
    NSURLSession *session = [NSURLSession sharedSession];

    NSURLSessionDownloadTask *downloadPhotoTask = [session downloadTaskWithURL:url completionHandler:^(NSURL *location, NSURLResponse *response, NSError *error) {
            NSData *imageData = [[NSData alloc] initWithContentsOfURL:location];
            dispatch_async(dispatch_get_main_queue(), ^{
                cell.tableImageView.image = [UIImage imageWithData:imageData];
        });
    }];

    [downloadPhotoTask resume];

Answer 1

Yes, you'll pass Review even with this parameter. We have uploaded many builds since iOS9 SDK with NSAllowsArbitraryLoads set to YES.

P.S.: Your code should better look like this:

cell.thumbnailURL = URL;
__weak typeof(cell) weak
NSURLSessionDownloadTask *downloadPhotoTask = [session downloadTaskWithURL:URL completionHandler:^(NSURL *location, NSURLResponse *response, NSError *error) {
    NSData *imageData = [[NSData alloc] initWithContentsOfURL:location];
    UIImage *image = [UIImage imageWithData:imageData];
    dispatch_async(dispatch_get_main_queue(), ^{
        if (weakCell.thumbnailURL != URL) {
            return;
        }
        weakCell.tableImageView.image = image;
    });
}];
[downloadPhotoTask resume];