Advanced Networking with URLSession

App Transport Security has been part of the Apple environment since iOS 9 and macOS El Capitan. It aims to enforce best practices for secure network connections in order to protect your users.

To fully support App Transport Security, or ATS, your app’s connections must be to servers that satisfy a list of requirements. They must be HTTPS not HTTP, and the server’s certificates issued by a certificate authority.

Even full ATS support is only a minimal approach to client-server security. Apps that transfer very sensitive data, like banking apps, need stronger security.

Network communications should guard against man in the middle attacks; where the attacker inserts itself into the connection between client and server. The attacker pretends to be the server, and sends its own public key to the client.

How does your app know it’s not the real server? One way is public key pinning, also called certificate pinning or SSL pinning. The server communicates its pinning policy to the client with a list of pinned public key hashes.

On future connections, the client can check the server’s public key against this list. You can implement pinning in the URLSession authentication challenge delegate.

Here are some suggestions for handling common use cases.

If you can influence your app’s back-end server, negotiate to get it set up to satisfy the ATS requirements.

If your app connects to a specific server that doesn’t satisfy the ATS requirements, you can add an exception for its domain to your info.plist file. Use the least weakening exception, not allows arbitrary loads.

If the server’s certificate is invalid, implement the URLSession authentication challenge delegate to accept the invalid certificate. Again, be specific, and don’t just accept any certificate.

If your app allows users to connect to a server they specify while using your app, you might be able to get away with allows arbitrary loads in web content.

When setting up your app for ATS, you’ll need to know some important keys.

ArbitraryLoadsInWebContent affects web view loads.

ArbitraryLoadsForMedia allows already encrypted media.

LocalNetworking allows unqualified and .local domains.

Setting ArbitraryLoads to yes requires justification to the App Store. It’s ignored if any of the previous 3 is present. Use it for development, and remove it for production.

As you can see, there are a lot of moving parts with App Transport Security. To stay abreast of all the changes, check out the latest WWDC videos and the Apple Developer Forums.

Demo

Time to work on this episode’s project. Open the Starter project and notice how there is a new About tab, along with some new views.

This new view shows some buttons that, when tapped, open the websites in an embedded WKWebView. There are three buttons that link to three different domains. The first domain is an HTTPS domain whereas the other two are HTTP.

Build and run the app. Tap on the HTTPS domain, the button to Objc.io. You’ll see the content loads fine.

Next, tap the Mokacoding button.N othing loads! This is because ATS is preventing the web view from accessing content over HTTP. Tap the final button for PBS. It loads even though it’s an HTTP URL? That’s because the site is redirecting us to an HTTPS site.

To get around the restriction of loading the Mokacoding site you can add an ATS exception.

First, you can opt out of ATS entirely. Open the Info.plist file and add a new key. Set it to App Transport Security Settings. Add another key, select Allow Abitrary Loads, and set it to true.

Before building and running the app again, delete it from the simulator. This allows you to get a fresh version of the app with the updated ATS settings.

Build and run. Now you can visit all the sites, but at the expense of turning off a security feature for your users.

Remember, if you provide any exceptions, you’ll need to explain the resons for those exceptions to the App Store review team. So far, you’ve opted out of ATS.

Instead, you may be connnecting to a server that doesn’t provide the level of security required by ATS. Back in my the Info.plist file, set arbitrary loads to false and then add a new key called NSExceptionDomains. Make it a dictionary.

Next, create a key and put the domain name, mokacoding.com in it. I’ll add two keys. One key is NSIncludesSubdomains that will be set to true so that subdomains will provide content.

Next, add an NSExceptionAllowsInsecureHTTPLoads and set it to true. Delete the app from the simulator to aquire the new ATS settings. Build and run.

Navigate to the About tab again and tap on Mokacoding. You’ll now be able to visit the site! There are lots of customization options for ATS, so be sure check out Apple’s documentation for more info.

You’ve reached the end of this episode and seen how networking is more than just downloading and sending data. Security, protocols, and the server’s setup play an important role in what your app does.

Join me in the next episode, where we’ll cover the final, most delicious topic of the entire course…Cookies! I’ll see ya there! :)