Cordova Hook for App Transport Security iOS 9

030_modify_plist.sh

#!/bin/bash

PLIST=platforms/ios/*/*-Info.plist

cat << EOF |
Add :NSAppTransportSecurity dict
Add :NSAppTransportSecurity:NSAllowsArbitraryLoads bool YES
EOF
while read line
do
    /usr/libexec/PlistBuddy -c "$line" $PLIST
done

true

Please don't set arbitrary loads to true, this will probably end in the rejection of your app. It is better to add exceptions per domain. Please see this stackoverflow answer: http://stackoverflow.com/a/30732693/441849

How could this be modified to add exceptions per domain?

Change:

Add :NSAppTransportSecurity dict
Add :NSAppTransportSecurity:NSAllowsArbitraryLoads bool YES

To:

Add :NSAppTransportSecurity dict
Add :NSAppTransportSecurity:NSExceptionDomains dict
Add :NSAppTransportSecurity:NSExceptionDomains:example.com dict
Add :NSAppTransportSecurity:NSExceptionDomains:example.com:NSIncludesSubdomains bool YES
Add :NSAppTransportSecurity:NSExceptionDomains:example.com:NSExceptionAllowsInsecureHTTPLoads bool YES

Where example.com is the domain you want to whitelist

My app will be allowing users to enter a domain to connect to my custom Node.js server they would install. Is that a good exception to the App Transport Security feature? I have custom logic to verify they are connected to a port running my service and not some random HTTP apache host.