Fix iOS 9 App Transport Security Issues In Apache Cordova

最新推荐文章于 2025-08-30 08:30:00 发布

zhangjianying

最新推荐文章于 2025-08-30 08:30:00 发布

阅读量1.7k

点赞数

分类专栏： JAVA学习文章标签： cordova ios security

JAVA学习专栏收录该内容

59 篇文章

订阅专栏

iOS9引入的AppTransportSecurity（ATS）导致ApacheCordova、IonicFramework和PhoneGap社区出现问题，如样式问题、权限问题和更严格的ATS安全要求。本文讨论如何解决使用InAppBrowser插件访问外部资源时遇到的SSL错误问题，包括在info.plist文件中添加NSAppTransportSecurity设置和创建域例外的方法。通过调整配置，开发者可以确保应用程序在iOS9及以上版本中保持正常功能。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

The release of iOS 9 has caused a mess of problems in the Apache Cordova, Ionic Framework, and PhoneGap communities. Problems spanning from styling issues, to permission issues, and even stricter security requirements that Apache Cordova wasn’t ready to handle.

Here I’m going to discuss App Transport Security (ATS) an issue that is rapidly appearing amongst app developers.

If your Apache Cordova application uses the InAppBrowser plugin to access external resources such as websites, you might have experienced the following error:

SSL Error
Shell
 
  
         1 
       
 
        webView 
        : 
        didFailLoadWithError 
          
        - 
          
        - 
        1200 
        : 
          
        An  
        SSL  
        error  
        has  
        occurred  
        and 
          
        a 
          
        secure  
        connection  
        to 
          
        the  
        server  
        cannot  
        be  
        made 
        . 
       
 
 

Although not fun to see, it is actually a good thing because iOS wants connections to be secure. This security measure can actually be overwritten to allow your application to perform like it did in earlier versions of iOS. You need to add the following to your Xcode info.plist file:

info.plist
XHTML
 
         1 
       
         2 
       
         3 
       
         4 
       
         5 
       
        <key> 
        NSAppTransportSecurity 
        </key> 
           
        <dict> 
           
        <key> 
        NSAllowsArbitraryLoads 
        </key> 
       
        <true  
        /> 
           
        </dict>

Building and running your application again should present better results. ATS is not limited to only the InAppBrowser plugin, even though that is the most reported cause that I see.

A Real Life Example

Let’s say you are using the ng-cordova-oauth library that I wrote. Out of the box it will work fine with Android and iOS versions earlier than 9.0. However in iOS 9 you’ll get ATS errors. When you try to initiate the oauth login flow you’ll be left with a blank screen wondering what went wrong.

If you don’t want to disable App Transport Security for all domains, you can make domain exceptions as described in the official documentation released by Apple. This will keep application security as strong as possible.

Conclusion

As much of a pain App Transport Security (ATS) seems in iOS 9, it is actually a positive thing for your users. With a few modifications you can make exceptions to allow communication between the application and insecure external resources.