Skip to content

iOS App Transport Security not Loading any Resources (HTTP) #760

Description

@AlecKriebel

Hi All,

I'm having an issue when attempting to load resources from within my Parse-Server backend iOS App.

App Transport Security is a feature on iOS apps that disallows connections if they are not https, and in my case, any resource (images, etc) URLs are loaded using http and so the connection is not allowed.

Note that I do not have this issue when loading normal data (user data, PFObjects, etc.).

My server URL client side and my SERVER_URL config parameter in Heroku are both https. I am using Heroku+MongoDB to host this Parse server.

Here are NSLogs from my iOS device simulation when trying to load a resource:

Error Domain=Parse Code=100 "The resource could not be loaded because the App Transport Security policy requires the use of a secure connection." 
UserInfo={code=100, NSLocalizedDescription=The resource could not be loaded because the App Transport Security policy requires the use of a secure connection., originalError=Error Domain=NSURLErrorDomain Code=-1022 "The resource could not be loaded because the App Transport Security policy requires the use of a secure connection." 
UserInfo={NSUnderlyingError=0x7f976fe2c800 {Error Domain=kCFErrorDomainCFNetwork Code=-1022 "(null)"}, NSErrorFailingURLStringKey=http://<URL>.herokuapp.com/parse/files/sUnFtZuPieaQaONJIkUEEECtNDZiuCjQzUH4K9FY/de36470e632cc17c67eeb646e3d41f64_profilepicture.png, NSErrorFailingURLKey=http://<URL>.herokuapp.com/parse/files/sUnFtZuPieaQaONJIkUEEECtNDZiuCjQzUH4K9FY/de36470e632cc17c67eeb646e3d41f64_profilepicture.png, NSLocalizedDescription=The resource could not be loaded because the App Transport Security policy requires the use of a secure connection.}, temporary=1, error=The resource could not be loaded because the App Transport Security policy requires the use of a secure connection.

How can I fix this issue?

Activity

  1. mpaulsonco commented on Mar 2, 2016

    @mpaulsonco

    Hi @AlecKriebel, I've found this guide to be helpful when working with ATS on iOS.

    As long as your resources are coming from the same domain, you'll probably want to follow Example B. If you're resources are coming from arbitrary domains, you'll most likely need to go with Example E.

  2. AlecKriebel commented on Mar 2, 2016

    @AlecKriebel
    Author

    @mpaulsonco Thanks for the guide.

    Example B is certainly a work-around, and if I can't solve this issue, that is certainly what I will implement, but I can't imagine that loading resources from MongoDB using https is impossible.

  3. nlutsenko commented on Mar 3, 2016

    @nlutsenko
    Contributor

    This is slightly disconnected from MongoDB, since clients actually won't ever talk to it.
    I recommend getting a SSL certificate and plugging this in front of your server.
    You can even get a free one from https://letsencrypt.org

    Both the workaround and plugging SSL Cert and moving your app to https will work.
    Going to close this one out, feel free to reopen if this still doesn't work for you.

  4. self-assigned this
    on Mar 3, 2016
  5. Charlesleonius commented on Sep 12, 2016

    @Charlesleonius

    Heroku automatically makes all the other endpoints https secure so how can I get it to do the same for the files endpoint?

  6. jayliew commented on Jan 18, 2017

    @jayliew

    @Charlesleonius did you figure out the answer to your question? Same issue for me here

  7. Charlesleonius commented on Jan 18, 2017

    @Charlesleonius

    @jayliew I ended up using a client side workaround. This is essentially the code I used to get around it, maybe you can modify it for your needs:

    let file = PFFile() //Placeholder 
    var url = file.url!
    if (!url.contains("https")) {
           url = url.insert(string: "s", ind: 4)
    }
    let URL = NSURL(string: url)!
    
  8. jayliew commented on Jan 18, 2017

    @jayliew
  9. flovilmart commented on Jan 18, 2017

    @flovilmart
    Contributor

    Try with setting publicServerURL, setting HTTPS. That should work

  10. jayliew commented on Jan 22, 2017

    @jayliew

    Can confirm this solved it for me when my images were not loading on a simulator from Parse on Heroku.

    Add this to Parse Server's index.js file where you create the server:

    publicServerURL: process.env.PARSE_PUBLIC_SERVER_URL || 'https://hostname.herokuapp.com/parse',

  11. mohanadhilles commented on Dec 11, 2017

    @mohanadhilles

    use it

    info.plist
    NSAppTransportSecurity

    NSExceptionDomains

    domain.com

    NSExceptionAllowsInsecureHTTPLoads

    NSIncludesSubdomains



  12. flovilmart commented on Dec 11, 2017

    @flovilmart
    Contributor

    You should run on HTTPS.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions