CyberCertPrepMobile Security FundamentalsMobile ConnectivityEASYFree question
Scenario
A developer uses a self-signed certificate on their test server and adds NSAllowsArbitraryLoads=true to their Info.plist to bypass ATS during development. After deployment to the App Store review, the reviewer rejects the app citing privacy concerns with the ATS exception.
An iOS developer notices their app successfully makes HTTPS requests with a self-signed certificate during testing. After submitting to the App Store the app is rejected. What ATS policy likely triggered the rejection and what is the correct fix?
- A.B) Apple allows NSAllowsArbitraryLoads=true without justification; the rejection is unrelated to ATS and the developer should appeal.
- B.A) NSAllowsArbitraryLoads=true disables ATS for all network connections globally; Apple requires a justification in the App Review Notes and the exception should be scoped to specific domains using NSExceptionDomains, or the self-signed cert should be replaced with a CA-signed certificate for production.
- C.