iOS App Transport Security (ATS) Disabled

Detects iOS ATS exceptions that allow insecure HTTP connections or disable certificate validation.

zakirkun Updated

File contents

iOS App Transport Security Disabled

Overview

iOS App Transport Security (ATS) enforces HTTPS and modern TLS for all network connections. Disabling ATS via NSAppTransportSecurity plist exceptions allows insecure HTTP connections and weakened TLS, enabling MITM attacks.

Remediation

  • Remove NSAllowsArbitraryLoads: true
  • Fix server TLS configuration to be ATS-compliant
  • Use specific domain exceptions only for legacy systems during migration

zakirkun/ice-tea/tree/main/skills/mobile/ios/ats-disabled commit 29bbe164b4

Frequently asked questions

npx skillmds@latest add zakirkun/ios-app-transport-security-ats-disabled