Swift and iOS secure coding¶

Swift applications still need explicit decisions about network trust, local storage and authorization. This guide focuses on iOS apps using Foundation URLSession and the App Transport Security configuration in Info.plist. Memory-safe language features do not protect credentials sent over an inadequately secured connection.

Remove a broad transport exception¶

The following XML fragments belong inside the root dictionary of the application's Info.plist. They are alternatives for the same setting.

Unsafe for an app that only needs approved HTTPS services: allow arbitrary loads.

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <true/>
</dict>

Safer: keep the broad exception disabled.

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <false/>
</dict>

When no exception is needed, remove the unnecessary exception configuration entirely. Apple documents the default and the interactions with other keys in NSAllowsArbitraryLoads. Review the whole dictionary: domain, web-content and media exceptions can affect the effective policy independently.

This change restores a more restrictive transport policy for the APIs to which ATS applies. It does not repair a custom trust delegate that accepts invalid certificates, secure a different networking stack automatically, or decide whether the user may access a record. Avoid broad bypasses added only to make a development endpoint connect; configure development trust deliberately and keep it out of release settings.

Check the fix¶

Inspect the final built release's plist, not just the source file. Use endpoints owned by your test team to verify that an approved HTTPS connection succeeds and an otherwise disallowed cleartext connection fails. Check the actual networking API used by the app. Treat differences caused by local networking or explicit exceptions as evidence to review, not as permission to add a global bypass.

Continue with cleartext protocols, certificate validation, hardcoded keys and insecure randomness. Keep sensitive tokens out of ordinary preference storage and logs.

This is a scoped configuration example. Source analysis, package inspection and runtime testing provide different evidence; none alone establishes complete iOS security.