iOS 10 中 ATS 的问题

怼烎@ 2022-06-08 13:54 335阅读 0赞

![https-lock.png][]

WWDC 15 提出的 ATS (App Transport Security) 是 Apple 在推进网络通讯安全的一个重要方式。在 iOS 9 和 OS X 10.11 中，默认情况下非 HTTPS 的网络访问是被禁止的。当然，因为这样的推进影响面非常广，作为缓冲，我们可以在 Info.plist 中添加 `NSAppTransportSecurity` 字典并且将 `NSAllowsArbitraryLoads` 设置为 `YES` 来禁用 ATS。相信大家都已经对这个非常熟悉了，因为我自己也维护了一些网络相关的框架，所以我还自己准备了一个[小脚本][Link 1]来快速关闭 ATS。

不过，WWDC 16 中，Apple 表示将继续在 iOS 10 和 macOS 10.12 里收紧对普通 HTTP 的访问限制。从 2017 年 1 月 1 日起，所有的新提交 app 默认是不允许使用 `NSAllowsArbitraryLoads` 来绕过 ATS 限制的，也就是说，我们最好保证 app 的所有网络请求都是 HTTPS 加密的，否则可能会在应用审核时遇到麻烦。

本文写作的时间点 (2016 年 6 月 17 日)，这方面的相关规定和几个事实如下。但是似乎 Apple 安全部门对现在的情况也有些内部冲突，所以不排除在正式版中发生改变的可能性。我也会对此继续关注，并在需要的时候对本文进行更新。如果您发现了下面所述和事实不符的话，也欢迎留言提出，我会进行修正。

1.  默认情况下你的 app 可以访问加密足够强 ([TLS][] v1.2 以上，AES-128 和 SHA-2 以及 ECDHC 等) 的 HTTPS 内容。这对所有的网络请求都有效，包括 `NSURLSession`，`UIWebView` 以及 `WKWebView` 等。
2.  你依然可以添加 `NSAllowsArbitraryLoads` 为 `YES` 来禁用 ATS，不过如果你这么做的话，需要在提交 app 时进行说明，为什么需要访问非 HTTPS 内容。一般来说，可能类似浏览器类的 app 比较容易能通过。
3.  相比于使用 `NSAllowsArbitraryLoads` 将全部 HTTP 内容开放，选择使用 `NSExceptionDomains` 来针对特定的域名开放 HTTP 应该要相对容易过审核。“需要访问的域名是第三方服务器，他们没有进行 HTTPS 对应”会是审核时的一个可选理由，但是这应该只需要针对特定域名，而非全面开放。如果访问的是自己的服务器的话，可能这个理由会无法通过。
4.  对于网页浏览和视频播放的行为，iOS 10 中新加入了 `NSAllowsArbitraryLoadsInWebContent` 键。通过将它设置为 `YES`，可以让你的 app 中的 `WKWebView` 和使用 `AVFoundation` 播放的在线视频不受 ATS 的限制。这也应该是绝大多数使用了相关特性的 app 的选择。但是坏消息是这个键在 iOS 9 中并不会起作用。

总结一下就是，对于 API 请求，基本上是必须使用 HTTPS 的，特别是如果你们自己可以管理服务器的话。可能需要后端的同学尽快升级到 HTTPS (不过话说虽然是用 Let's Encrypt 的，我一个个人博客都启用 HTTPS 了，作为 API 的用户服务器，还不开 HTTPS 真有点说不过去)。如果你的 app 只支持 iOS 10，并且有用户可以自由输入网址进行浏览的功能，或者是在线视频音频播放功能的话，简单地加入 `NSAllowsArbitraryLoadsInWebContent`，并且将组件换成 `WKWebKit` 或者 `AVFoundation` 就可以了。如果你还需要支持 iOS 9，并且需要访问网页和视频的话，可能只能去开启 `NSAllowsArbitraryLoads` 然后提交时进行说明，并且看 Apple 审核员的脸色决定让不让通过了。除了 `WKWebKit` 以外，另外一个访问网页的选择是使用 `SFSafariViewController`。因为其实 `SFSafariViewController` 就是一个独立于 app 的 Safari 进程，所以它完全不受 ATS 的限制。

另外，当 `NSAllowsArbitraryLoads` 和 `NSAllowsArbitraryLoadsInWebContent` 同时存在时，根据系统不同，表现的行为也会不一样。简单说，iOS 9 只看 `NSAllowsArbitraryLoads`，而 iOS 10 会先看 `NSAllowsArbitraryLoadsInWebContent`。在 iOS 10 中，要是 `NSAllowsArbitraryLoadsInWebContent` 存在的话，就忽略掉 `NSAllowsArbitraryLoads`，如果它不存在，则遵循 `NSAllowsArbitraryLoads` 的设定。说起来可能有点复杂，我在这里总结了一下根据 `NSAppTransportSecurity` 中设定条件不同，所对应的系统版本和请求组件的行为的不同，可以作为你设置这个字典时的参考。

<table style="border-collapse:collapse; border-spacing:0px; max-width:100%; margin:50px auto; padding:0px; border:2px solid rgb(146,18,30); font-family:ff-tisa-web-pro-1,ff-tisa-web-pro-2,&quot;Lucida Grande&quot;,&quot;Hiragino Sans GB&quot;,&quot;Hiragino Sans GB W3&quot;,&quot;Microsoft YaHei&quot;,&quot;WenQuanYi Micro Hei&quot;,sans-serif; font-size:0.9em; line-height:40px; vertical-align:baseline; color:rgb(51,51,51); text-align:center; width:641px"> 
 <thead style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
  <tr style="margin:0px; padding:0px; border:none; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline; background-color:rgb(146,18,30); color:rgb(248,248,248)"> 
   <th style="text-align:left; margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ATS 设定</th> 
   <th style="text-align:left; margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 使用的组件</th> 
   <th style="text-align:left; margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> iOS 9 HTTP</th> 
   <th style="text-align:left; margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> iOS 10 HTTP</th> 
   <th style="text-align:left; margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 备注</th> 
  </tr> 
 </thead> 
 <tbody style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> NSAllowsArbitraryLoads: NO</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> UIWebView</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> WKWebView</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 默认行为</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> URLSession</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> NSAllowsArbitraryLoads: YES</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> UIWebView</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ✅</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ✅</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 禁用 ATS</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> WKWebView</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ✅</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ✅</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 审核时需要说明理由</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> URLSession</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ✅</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ✅</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> NSAllowsArbitraryLoads: NO &amp; NSAllowsArbitraryLoadsInWebContent: YES</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> UIWebView</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 只对网页内容禁用 ATS</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> WKWebView</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ✅</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 对于大多数 app 的推荐做法，</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> URLSession</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 保证安全性</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> NSAllowsArbitraryLoads: NO &amp; NSAllowsArbitraryLoadsInWebContent: NO</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> UIWebView</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> WKWebView</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> URLSession</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> NSAllowsArbitraryLoads: YES &amp; NSAllowsArbitraryLoadsInWebContent: NO</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> UIWebView</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ✅</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 对于 iOS 10，</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> WKWebView</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ✅</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> NSAllowsArbitraryLoadsInWebContent 存在时忽略 NSAllowsArbitraryLoads 的设置</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> URLSession</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ✅</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> iOS 9 将继续使用 NSAllowsArbitraryLoads</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> NSAllowsArbitraryLoads: YES &amp; NSAllowsArbitraryLoadsInWebContent: YES</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> UIWebView</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ✅</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 对于 iOS 10，</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> WKWebView</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ✅</td> 
   <td style="margin:0px; padding:0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ✅</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border-width:0px 0px 1px; border-bottom-style:solid; border-bottom-color:rgb(221,221,221); font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> NSAllowsArbitraryLoadsInWebContent 存在时忽略 NSAllowsArbitraryLoads 的设置</td> 
  </tr> 
  <tr style="margin:0px; padding:0px; border:0px; font-family:inherit; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> 
   <td style="margin:0px; padding:0px 15px 0px 20px; border:none; font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> &nbsp;</td> 
   <td style="margin:0px; padding:0px; border:none; font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> URLSession</td> 
   <td style="margin:0px; padding:0px; border:none; font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ✅</td> 
   <td style="margin:0px; padding:0px; border:none; font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> ❌</td> 
   <td style="margin:0px; padding:0px 10px 0px 0px; border:none; font-family:inherit; font-size:0.85em; font-style:inherit; font-variant:inherit; line-height:inherit; vertical-align:baseline"> iOS 9 将继续使用 NSAllowsArbitraryLoads</td> 
  </tr> 
 </tbody> 
</table>

> 该列表是根据 Apple prerelease 的[文档][Link 2]中关于 `NSAppTransportSecurity` 和 `NSAllowsArbitraryLoadsInWebContent` 部分的描述作出的。现在 (2016.06.17) 的 iOS 10 beta 和 Xcode 8 beta 版本中 `NSAllowsArbitraryLoadsInWebContent` 似乎还不能正确工作。在现在的 beta 版中，似乎只要存在 `NSAllowsArbitraryLoadsInWebContent`，不论其设置如何，`WKWebView` 都不能加载。如果这个行为发生了变化，或者上面的列表存在问题，欢迎留言，我会进行更正。

关于 `UIWebView` 是否也可以在 `NSAllowsArbitraryLoadsInWebContent` 为 `YES` 时访问 HTTP，Apple 内部似乎也在争论，但是个人认为是时候淘汰 `UIWebView` 了。如果没有特殊的什么需求的话，尽早将 `UIWebView` 全部换为 `WkWebView` 会是明智的选择。

不得不说，Apple 使用自己现在的强势地位，在推动技术进步上的做的努力是有目共睹的。不论是前几天强制支持 IPv6，还是现在的 HTTPS，其实都不是很容易就能作出的决定。而为用户构建一个更安全的使用环境，可能不仅是 Apple 单方面可以做的，也是需要开发者来配合的一件事情。尽快适配更进步和安全的使用方式，会是一件双赢的事情。

[https-lock.png]: /images/20220608/7fb3c82b0592478a97f62395a06839ae.png
[Link 1]: https://gist.github.com/onevcat/b4604aecb4ce55651a4a
[TLS]: https://en.wikipedia.org/wiki/Transport_Layer_Security
[Link 2]: https://developer.apple.com/library/prerelease/content/documentation/General/Reference/InfoPlistKeyReference/Articles/CocoaKeys.html