Cordova / PhoneGap Plugin to allow 'Arbitrary Loads' by adding a declaration to the Info.plist file to bypass the iOS 9 App Transport Security
Latest published version on npm (with Cordova CLI >= 5.0.0)
cordova plugin add cordova-plugin-transport-security
Latest version from GitHub
cordova plugin add https://github.com/leecrossley/cordova-plugin-transport-security.git
App Transport Security (ATS) enforces best practices in the secure connections between an app and its back end. ATS prevents accidental disclosure, provides secure default behavior, and is easy to adopt; it is also on by default in iOS 9 and OS X v10.11. You should adopt ATS as soon as possible, regardless of whether you’re creating a new app or updating an existing one.
If you’re developing a new app, you should use HTTPS exclusively. If you have an existing app, you should use HTTPS as much as you can right now, and create a plan for migrating the rest of your app as soon as possible. In addition, your communication through higher-level APIs needs to be encrypted using TLS version 1.2 with forward secrecy. If you try to make a connection that doesn't follow this requirement, an error is thrown. If your app needs to make a request to an insecure domain, you have to specify this domain in your app's Info.plist file.
Source: iOS Developer Library
It's important to note that this does not impact apps built with Xcode < 7 running on iOS 9.
In case you want specify your domain as an exception domain in ATS, open
NSAllowsArbitraryLoads value (line:17) to
false and add
NSExceptionDomains just like this:
<dict> <key>NSAllowsArbitraryLoads</key> <false/> <key>NSExceptionDomains</key> <dict> <key>www.github.com</key> <dict> <key>NSExceptionAllowsInsecureHTTPLoads</key> <true/> <key>NSIncludesSubdomains</key> <true/> </dict> </dict> </dict>
For the changes to
plugin.xml to take effect, you must refresh the
ios.json file (inside the
$ cordova platform rm ios $ cordova platform add ios
Find more about App Transport Security:
Applies to iOS (9+) only.