ATS Exception Insecure HTTP Loads

ID

swift.ats_exception_insecure_http_loads

Severity

high

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

medium

Resource

Information Leak

Language

Swift

Tags

ASVS50:v12.2.1, ASVS50:v12.3.1, ASVS50:v12.3.3, ASVS50:v4.4.1, ASVS50:v4.4.4, CWE:319, MASVS:MSTG-NETWORK-1, OWASP:2025:A06

Description

Each child dictionary of NSAppTransportSecurity.NSExceptionDomains relaxes App Transport Security (ATS) for the named host. When the exception sets NSExceptionAllowsInsecureHTTPLoads to true, the app may reach that host over plain HTTP regardless of the top-level NSAllowsArbitraryLoads setting.

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>api.example.com</key>  <!-- FLAW -->
        <dict>
            <key>NSExceptionAllowsInsecureHTTPLoads</key>
            <true/>
        </dict>
    </dict>
</dict>

Rationale

Per-domain HTTP exceptions are easy to add for a one-off integration test and are routinely forgotten. They expose credentials and session tokens to anyone on the network path between device and server. The loopback hosts localhost and 127.0.0.1 are tolerated by default because they cover simulator and tunnel development.

Remediation

Remove the offending domain or set NSExceptionAllowsInsecureHTTPLoads to false. Migrate the upstream service to HTTPS. If a vendor refuses to ship TLS, scope the exception as narrowly as possible and document why it cannot be removed.

References