App Transport Security通过自定义URL方案阻止路由

Question

My iOS app (written in Swift and React Native) has a custom url scheme that allows me to route to the app from eg Safari like this myappscheme://https://www.mywebsite.com/somematerial . If I enable App Transport Security in my app, the routing via custom url scheme is blocked and I get this message:

App Transport Security has blocked a cleartext HTTP (http://) resource load since it is insecure. Temporary exceptions can be configured via your app's Info.plist file.

However, if I disable ATS, the app routes as expected. I am not accessing any link via http in my app and in my routing I always fetch data via https. Therefore, I don't know why ATS is blocking this routing. Do you know if I have to provide some additional info about my url scheme?

Please see my ATS configurations in Info.plist:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoadsInWebContent</key>
    <true/>
    <key>NSExceptionDomains</key>
    <dict>
        <key>localhost</key>
        <dict>
            <key>NSIncludesSubdomains</key>
            <true/>
            <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
            <true/>
        </dict>
    </dict>
</dict>

I've also whitelisted my custom url scheme:

<key>LSApplicationQueriesSchemes</key>
<array>
    <string>myappscheme</string>
</array>

Answer 1

This issue has been resolved. I logged out the endpoint I was hitting and checked if it satisfied ATS requirements by doing in Terminal:

nscurl --ats-diagnostics https://www.example.com/

It turned out that the particular subdomain I was trying to fetch failed all ATS requirements. My server team has fixed the issue and made the endpoint secure.

Answer 2

I think the problem is with React Native, you mentioned that you use Safari as a source for custom links and probably it means that you're trying to debug your app & custom routing in Simulator, so maybe your issue related to React Native. If you have the same behaviour on a real device when React Native works offline, then please update your question.

Temporarily disable App Transport Security (ATS) by adding the NSAllowsArbitraryLoads entry to your Info.plist file. Since ATS does not allow insecure HTTP requests to IP addresses, you must completely disable it to run on a device. This is only a requirement for development on a device, and unless you can't workaround an issue you should leave ATS enabled for production builds. For more information, see this post on configuring ATS.

React Native Documentation - Running On Device

Answer 3

Configure info.plist setting.

You can add a specific domain like:

<dict>
    <key>NSAllowsArbitraryLoads</key>
    <true/>
    <key>NSExceptionDomains</key>
    <dict>
        <key>www.google.com</key>
        <dict>
            <key>NSIncludesSubdomains</key>
            <true/>
            <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
            <true/>
            <key>NSTemporaryExceptionMinimumTLSVersion</key>
            <string>TLSv1.1</string>
        </dict>
    </dict>
</dict>