Does App Store reject submission if NSAllowsArbitraryLoads set to YES?

Question

The new ATS involved by iOS 9 cause lots of http related functionalities stop working. I have to add all the http request url into a whitelist or I could simply disable the

Answer 1

Thanks for everyone's answer.

The good news is Apple Accepted my app with NSAllowsArbitraryLoads set to YES.

UPDATE (Thanks @Vijayts): Apple will reject Apps not conforming to ATS after the end of Dec 2016.

Source

However, If you need to load a http:// resource only in web (UIWebView/WKWebView/SafariViewController) then the following should suffice.

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoadsInWebContent</key>
    <true/>
</dict>

Answer 2

Latest we heard from Apple about NSAllowsArbitraryLoads was in Dec 2016. https://developer.apple.com/news/?id=12212016b

Apple is still accepting new apps and updates. My new app got approved in April 2017 with NSAllowsArbitraryLoads set to YES. I recently submitted updates too, no issues no rejection.

Answer 3

It seems Apple has changed its plans:

Supporting App Transport Security

To give you additional time to prepare, this deadline has been extended and we will provide another update when a new deadline is confirmed. https://developer.apple.com/news/?id=12212016b

Answer 4

I have an app that allows users to specify a URL to be displayed in a web view during execution. This URL may be an HTTP URL. For this reason I include NSAllowsArbitraryLoads set to yes.

I have submitted an update to this app after December 2016 and had no problems.

My plist also specifies NSAllowsArbitraryLoadsInWebContent and I specify exceptions that activate TLS for known web services that my app uses where TLS is supported.

I simply included a review note that explained that NSAllowsArbitraryLoadsInWebContent is not sufficient since my app is supported on iOS 9.

I have never even had a question from app review on this.

Answer 5

All connections using the NSURLConnection, CFURL, or NSURLSession APIs use App Transport Security default behavior in apps built for iOS 9.0 or later, and OS X 10.11 or later. Connections that do not follow the requirements will fail.

However, You can specify exceptions to the default behavior in the Info.plist file in your app or extension. Use the keys in the property list for specific exceptions or to turn off App Transport Security. Table 1-1 shows the keys and their types, and uses indentation to indicate structure.

Here is the source link: https://developer.apple.com/library/prerelease/ios/technotes/App-Transport-Security-Technote/index.html

Answer 6

UPDATE: Apple will reject Apps not conforming to ATS after the end of Dec 2016.

Source

However, If you need to load a http:// resource only in web (UIWebView/WKWebView/SafariViewController) then the following should suffice.

NOTE: This key is available only from iOS 10.

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoadsInWebContent</key>
    <true/>
</dict>