How to connect to a non-secure localhost websocket on iOS?

Question

I have a Qt application which bundles a browser and an application which hosts a non-secure websocket server on port 50050. The browser tries to connect to the application via ws://127.0.0.1:50050 and this works out well on macOS. On iOS, however, the connection fails. I'd suspect this is due to iOS specific security settings – also because the dialog to allow local.network usage does not show up. Please find here the list of.network related security keys I applied in the Info.plist file

<key>NSLocalNetworkUsageDescription</key>
<string>Uses local networking to communicate settings…</string>
<key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key><true/>

<key>NSAppTransportSecurity</key>
       <dict>
                <key>NSAllowsArbitraryLoads</key><true/>
                <key>NSAllowsArbitraryLoadsForMedia</key><true/>
                <key>NSAllowsArbitraryLoadsInWebContent</key><true/>
                <key>NSAllowsLocalNetworking</key><true/>
                <key>NSExceptionDomains</key>
                <dict>
                        <key>localhost</key>
                        <dict>
                                <key>NSExceptionAllowsInsecureHTTPLoads</key><true/>
                                <key>NSIncludesSubdomains</key><true/>
                        </dict>
                        <key>mydomain.com</key>
                        <dict>
                                <key>NSExceptionAllowsInsecureHTTPLoads</key><true/>
                                <key>NSIncludesSubdomains</key><true/>
                        </dict>
                </dict>
        </dict>

Am I missing anything in terms of security keys or does anyone have a different suggestions how to resolve this issue?

Answer 1

On iOS non-secure websockets (neither localhost) are not permitted in context with secure websites (https). On OSX it is permitted for any browser except Safari. The solution is to either use non-secure websites (http) or create a secure websocket on localhost if https is required.