iOS App Transport Security Disabled
Overview
iOS App Transport Security (ATS) enforces HTTPS and modern TLS for all network connections. Disabling ATS via NSAppTransportSecurity plist exceptions allows insecure HTTP connections and weakened TLS, enabling MITM attacks.
Remediation
- Remove
NSAllowsArbitraryLoads: true - Fix server TLS configuration to be ATS-compliant
- Use specific domain exceptions only for legacy systems during migration