ATS 🍎 iOS

App Transport Security has blocked a cleartext HTTP resource load

iOS blocked an http:// request (or a weak-TLS HTTPS one) because App Transport Security requires secure connections.

Seen on: iOS

Meaning

ATS requires HTTPS with TLS 1.2+ and forward secrecy. Plain HTTP or old server TLS configs fail with NSURLErrorDomain -1022. App Review questions broad ATS exceptions.

Common causes

  • API URL uses http://
  • Local dev server over HTTP
  • Server TLS too old / weak ciphers
  • Third-party SDK using HTTP

⚡ Quick fix

  1. Serve the API over HTTPS with modern TLS
  2. For dev only, add a per-domain exception (not NSAllowsArbitraryLoads)
  3. Test the server with nscurl --ats-diagnostics https://host

Detailed fix by platform

iOS

  1. Info.plist exception for one domain:
    xml
    <key>NSAppTransportSecurity</key>
<dict>
  <key>NSExceptionDomains</key>
  <dict>
    <key>dev.example.local</key>
    <dict>
      <key>NSExceptionAllowsInsecureHTTPLoads</key><true/>
    </dict>
  </dict>
</dict>

How to diagnose

  1. URL — http or https?
  2. TLS — nscurl --ats-diagnostics result
  3. Scope — Debug only or release?

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.