# NSAppTransportSecurity A description of changes made to the default security for HTTP connections. ## Discussion On Apple platforms, a networking feature called App Transport Security (ATS) improves privacy and data integrity for all apps and app extensions. ATS requires that all HTTP connections made with the —typically using the class—use HTTPS. It further imposes extended security checks that supplement the default server trust evaluation prescribed by the Transport Layer Security (TLS) protocol. ATS blocks connections that fail to meet minimum security specifications. For additional details, see . You can circumvent or augment these protections by adding the [`NSAppTransportSecurity`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity) key to your app’s [`Information Property List`](/documentation/BundleResources/Information-Property-List) file and providing an ATS configuration dictionary as the value. For example, you can: - Allow insecure loads for web views while maintaining ATS protections elsewhere in your app using the [`NSAllowsArbitraryLoadsInWebContent`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSAllowsArbitraryLoadsInWebContent) key. - Enable additional security features like Certificate Transparency using the [`NSRequiresCertificateTransparency`](/documentation/BundleResources/Information-Property-List/NSRequiresCertificateTransparency) key, or Certificate Pinning using the [`NSPinnedDomains`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSPinnedDomains) key. - Reduce or remove security requirements for communication with particular servers using the [`NSExceptionDomains`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSExceptionDomains) key. > Important: > Always look for ways to improve server security before adding ATS exceptions. Loosening ATS restrictions reduces the security of your app. All keys in the ATS configuration dictionary are optional, with default values that are suitable for most apps. Keys that define global exceptions apply to all network connections made by your app, except connections to domains specified in the [`NSExceptionDomains`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSExceptionDomains) sub-dictionary. That sub-dictionary allows you to separately manage settings for individual domains. ### Versioning ATS operates by default for apps linked against the iOS 9.0 or macOS 10.11 SDKs or later. When you link your app against an older SDK, ATS is disabled no matter which version of operating system your app runs on. If you specify a value for any of the global exceptions besides [`NSAllowsArbitraryLoads`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSAllowsArbitraryLoads), then the ATS behavior depends on the version of the OS on which your app runs: - iOS 9.0 or macOS 10.11: ATS uses the [`NSAllowsArbitraryLoads`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSAllowsArbitraryLoads) value that you set, or NO by default, and ignores the other global exceptions. - iOS 10.0 or later or macOS 10.12 or later: ATS ignores the [`NSAllowsArbitraryLoads`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSAllowsArbitraryLoads) value that you set and instead obeys the other key or keys. This behavior enables you to manage differences between OS versions. You provide a coarse exception ([`NSAllowsArbitraryLoads`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSAllowsArbitraryLoads)) for older versions, and a more targeted exception, like [`NSAllowsArbitraryLoadsInWebContent`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSAllowsArbitraryLoadsInWebContent), for when it’s available. ## Topics ### Global Exceptions [`NSAllowsArbitraryLoads`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSAllowsArbitraryLoads) A Boolean value indicating whether App Transport Security restrictions are disabled for all network connections. [`NSAllowsArbitraryLoadsForMedia`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSAllowsArbitraryLoadsForMedia) A Boolean value indicating whether all App Transport Security restrictions are disabled for requests made using the AV Foundation framework. [`NSAllowsArbitraryLoadsInWebContent`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSAllowsArbitraryLoadsInWebContent) A Boolean value indicating whether all App Transport Security restrictions are disabled for requests made from web views. [`NSAllowsLocalNetworking`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSAllowsLocalNetworking) A Boolean value that indicates whether to allow local resources to load. ### Domain-Specific Exceptions [`NSExceptionDomains`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSExceptionDomains) Custom App Transport Security (ATS) configurations for named domains. ### Certificate Pinning [`NSPinnedDomains`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSPinnedDomains) A collection of certificates that App Transport Security expects when connecting to named domains. ### TLS Functionality Package Compliance [`NSRequiresNIAPTLSPackageVersion`](/documentation/BundleResources/Information-Property-List/NSRequiresNIAPTLSPackageVersion) A string that indicates the version to use for the NIAP Functional Package for TLS. [`NSExceptionRequiresNIAPTLSPackageVersion`](/documentation/BundleResources/Information-Property-List/NSExceptionRequiresNIAPTLSPackageVersion) A string that indicates the version to use for the NIAP Functional Package for TLS, applied to an exception domain. ## See Also --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)