ATS Allows Arbitrary Loads In Web Content

ID

swift.ats_allows_arbitrary_loads_in_web_content

Severity

high

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

medium

Resource

Information Leak

Language

Swift

Tags

ASVS50:v12.2.1, ASVS50:v12.3.1, ASVS50:v12.3.3, ASVS50:v4.4.1, ASVS50:v4.4.4, CWE:319, MASVS:MSTG-NETWORK-1, OWASP:2025:A06

Description

The NSAllowsArbitraryLoadsInWebContent key in Info.plist disables App Transport Security (ATS) for content loaded inside WKWebView and the legacy UIWebView. When set to true, embedded web views will fetch pages and sub-resources over plain HTTP without complaint.

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoadsInWebContent</key>  <!-- FLAW -->
    <true/>
</dict>

Rationale

The bypass survives review at organisations that scan only the top-level NSAllowsArbitraryLoads flag: NSAllowsArbitraryLoadsInWebContent is a separate, narrower ATS opt-out frequently enabled for a quick test against an HTTP page and forgotten. Attackers on the network path can inject script into the WebView and pivot into the host app.

Remediation

Remove the key or set it to false. Migrate any HTTP pages to HTTPS; if a single host must stay HTTP, add a narrow NSExceptionDomains entry scoped to that domain only.

References