Developing for iOS9

If you are developing on iOS or plan to, here is a significant change that you should be aware of. This is direct from Apple’s iOS Developer Library — Prerelease notes for iOS 9. Apple wants developers to use HTTPS exclusively. It looks like for now they will allow exceptions, but chances are that in the future they will remove support for port 80. Since 443 requires a valid cert to connect without warnings, and in some cases connect at all, does this mean Apple’s change will force people to buy SSL certs, even if they don’t need the extra security? I think it’s great that they are looking to contentiously improve security, but I wonder how this will impact developers who build apps with HTTP requirements, but do not require the extra level of security.

App Transport Security

App Transport Security (ATS) enforces best practices in the secure connections between an app and its back end. ATS prevents accidental disclosure, provides secure default behavior, and is easy to adopt; it is also on by default in iOS 9 and OS X v10.11. You should adopt ATS as soon as possible, regardless of whether you’re creating a new app or updating an existing one.

If you’re developing a new app, you should use HTTPS exclusively. If you have an existing app, you should use HTTPS as much as you can right now, and create a plan for migrating the rest of your app as soon as possible. In addition, your communication through higher-level APIs needs to be encrypted using TLS version 1.2 with forward secrecy. If you try to make a connection that doesn’t follow this requirement, an error is thrown. If your app needs to make a request to an insecure domain, you have to specify this domain in your app’s Info.plist file.

 

You may also like...