The resource could not be loaded because the App Transport Security policy requires the use of a secure connection

Question

I am facing the Problem when I have updated my Xcode to 7.0 or iOS 9.0. Somehow it started giving me the Titled error

\"The resource could not be load

Answer 1

This is Apple's way of forcing tighter security on your apis(forced to use https over http). I'll explain how to remove this security setting.

---

Most answers on here point out adding this key to your info.plist

This alone did not solve this problem for me. I had to add the same key to inside

Project -> Targets -> Info -> Custom iOS Target Properties

---

This will allow insecure connections to happen from anyone however. If you want to allow only a specific domain to use make insecure connections, you can add the following to your info.plist.

Answer 2

In Xcode 7.1 onwards(swift 2.0)

Answer 3

I managed to solve this with a combination of many of the mentioned options. I’ll include a checklist of all of the things I had to do to get this to work.

In short:

1. Set NSAllowsArbitraryLoads to true for my watch extension (not my watch app).
2. Ensure I was using https and not http.

---

Step one:

Firstly and most obviously I had to add an NSAppTransportSecurity key as a dictionary in my watch extension’s info.plist with a subkey called NSAllowsArbitraryLoads as a boolean set to true. Only set this in the watch extension and not the watch app’s plist. Although take note that this allows all connections and could be insecure.

or

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <true/>
</dict>

---

Step two:

Then I had to make sure that the url I was trying to load was https and not just http. For any urls that were still http I used:

Swift:

let newURLString = oldURLString.stringByReplacingOccurrencesOfString("http", withString: "https")

Obj-C:

NSString *newURLString = [oldURLString stringByReplacingOccurrencesOfString:@“http” withString:@“https”];

Answer 4

iOS 9 (may) force developers to use App Transport Security exclusively. I overheard this somewhere randomly so I don't know whether this is true myself. But I suspect it and have come to this conclusion:

The app running on iOS 9 will (maybe) no longer connect to a Meteor server without SSL.

This means running meteor run ios or meteor run ios-device will (probably?) no longer work.

In the app's info.plist, NSAppTransportSecurity [Dictionary] needs to have a key NSAllowsArbitraryLoads [Boolean] to be set to YES or Meteor needs to use https for its localhost server soon.

Answer 5

For those of you developing on localhost follow these steps:

1. Tap the "+" button next to Information Property List and add App Transport Security Settings and assign it a Dictionary Type
2. Tap the "+" button next to the newly created App Transport Security Settings entry and add NSExceptionAllowsInsecureHTTPLoads of type Boolean and set its value to YES.
3. Right click on NSExceptionAllowsInsecureHTTPLoads entry and click the "Shift Row Right" option to make it a child of the above entry.
4. Tap the "+" button next to the NSExceptionAllowsInsecureHTTPLoads entry and add Allow Arbitrary Loads of type Boolean and set its value to YES

Note: It should in the end look something like presented in the following picture

Answer 6

Open your pList.info as Source Code and at bottom just before </dict> add following code,

 <!--By Passing-->
    <key>NSAppTransportSecurity</key>
    <dict>
        <key>NSExceptionDomains</key>
        <dict>
            <key>your.domain.com</key>
            <dict>
                <key>NSIncludesSubdomains</key>
                <true/>
                <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
                <true/>
                <key>NSTemporaryExceptionMinimumTLSVersion</key>
                <string>1.0</string>
                <key>NSTemporaryExceptionRequiresForwardSecrecy</key>
                <false/>
            </dict>
        </dict>
    </dict>
    <!--End Passing-->

And finally change your.domain.com with your base Url. Thanks.