App Transport Security is a feature that improves the security of connections between an app and web services. The feature consists of default connection requirements that conform to best practices for secure connections. Apps can override this default behavior and turn off transport security.1

If you’re building your iOS App with the latest dev tools (Xcode 7), your App will automatically be opted in to App Transport Security, which essentially means that for your network requests to succeed, the following must be true for each of your endpoints:

  • The server must support at least Transport Layer Security (TLS) protocol version 1.2.
  • Connection ciphers are limited to those that provide forward secrecy.
  • Certificates must be signed using a SHA256 or greater signature hash algorithm, with either a 2048-bit or greater RSA key or a 256-bit or greater Elliptic-Curve (ECC) key.

One month since the public launch of this feature, I was interested to know how many developers had not opted out of this new feature. To get a rough idea, I sampled the current top 200 free iOS apps in the UK store and checked.

Here are the results:

  • Only 2% apps are ATS Compliant ; this includes two of Apple’s apps.
  • 3% created exceptions for a finite number of domains - this might be required if you do not have control over the endpoints you’re hitting.
  • 24% disabled the feature altogether - they do this by allowing arbitrary domains to proceed without enforcing the criteria above.
  • The rest have not yet released a version made with Xcode 7, which means this feature does not apply to them; if the past is any guide, Apple will enforce all new apps and updates to be made with Xcode 7 in February 2016.

As Xcode 7 is quite new, I’m not particularly surprised by these numbers, but it will be interesting to see how developers react to ATS over the coming months, and what users’ perception of an app will be if it is subverting this feature in six months.

Are you planning to support it?

For completeness, the raw data as of the time of writing is below.

AppBuilt with Xcode 7No Arbitrary LoadsNumber of domains exceptedATS Compliant
ATS Compliant Apps (4)
Apple Store✔︎✔︎0✔︎
Fallout Shelter✔︎✔︎0✔︎
Translate✔︎✔︎0✔︎
iTunes U✔︎✔︎0✔︎
Apps with Only Finite Domain Exceptions (6)
Citymapper✔︎✔︎14
Dubsmash✔︎✔︎7
Everalbum✔︎✔︎26
JUST EAT✔︎✔︎5
Recolor✔︎✔︎7
HOOKED✔︎✔︎4
Apps Allowing Arbitrary Loads (48)
ASOS✔︎0
AmpMe✔︎0
Auto Trader✔︎0
BBC iPlayer✔︎0
Booking.com✔︎0
Can you get Z✔︎0
Case Clicker✔︎0
Castle Clash✔︎0
Crossy Road✔︎5
Doodle God✔︎0
Dropbox✔︎0
Facebook✔︎0
Fit the Fat✔︎0
Flipagram✔︎3
Framatic✔︎0
GIF Keyboard✔︎0
Instagram✔︎4
Instant picframes - collage frame maker✔︎0
KICK✔︎3
LinkedIn✔︎0
Magic Piano✔︎0
Messenger✔︎0
Musi✔︎0
MyFitnessPal✔︎3
Netflix✔︎0
Outlook✔︎0
Pic Collage✔︎2
Pinterest✔︎5
Skype✔︎0
Smashy Road: Wanted✔︎0
Sonic Boom✔︎0
THE YUB✔︎3
Trainline✔︎0
TripAdvisor✔︎0
Tumblr✔︎0
Twitter✔︎0
Vine✔︎3
WhatsApp✔︎0
WordUp✔︎2
Word✔︎0
Yik Yak✔︎0
Amazon✔︎0
Shazam✔︎0
easyJet✔︎0
game001-gnetop-russian✔︎0
imo✔︎0
ooVoo✔︎0
shpock✔︎0
Apps Not Built with Xcode 7 (142)
100 Balls--
100 Pics--
1010!--
360 Degree--
8 Ball Pool--
Agar.io--
AirSupremacy--
All 4--
Angry Birds 2--
Argos--
AutoRap--
BBC News--
BBC Sport--
Baby Boom--
Banking--
BikeRaceTFG--
Bingo--
Block Craft 3D--
Boom Beach--
Boots--
BountyBucks--
Bowling King--
Burger King--
Candy Crush--
Candy Crush--
Catch Phrase--
Chrome--
Close Up Pics--
Cloud Music--
Color Pop--
Colorfy--
Companion--
Cooking Fever--
Countdown+--
Deezer--
Depop--
Domino's--
Don't Fall--
Draw Free--
Dream Treats--
Episode--
FIFA 16 UT--
Flow Free--
FreePlay--
FreePrints--
Geek--
Geometry Lite--
Gmail--
Google Earth--
Google Maps--
Google--
Groupon--
Gumtree--
Halifax--
Happy Wheels--
Hotel Transylvania 2--
ITV Player--
Indeed Jobs--
JD Sports--
Jenga--
Jetpack--
Kik--
Kill Shot--
Ladbrokes--
Layout--
Lloyds Bank--
Logos--
MY EE--
Minion Rush--
Minions--
Mr. Square--
MusicDownloader--
MusicStreamer--
My Bowling 3D--
My O2--
My Vodafone--
NFS™ NL--
NatWest--
National Rail--
Nonsense--
POF--
PayPal--
Photo Editor---
PlayTube--
Pop the Lock--
Relic Run--
Retrica--
Rightmove--
Score Centre--
Score! Hero--
Score!--
SimCity--
Sing!--
Sky Go--
Sky Sports--
Slingshot--
Snap Upload--
Snapchat--
Sniper 3D--
SoundCloud--
Spinny Circle--
Spotify--
Subway Surf--
Tapped Out--
Temple Run 2--
Temple Run--
The National Lottery--
Three--
Tinder--
Toy Army--
Tube Master--
Uber--
The movie box & Pro moviebox & playbox free Film HD--
Uploader--
Viber--
Visage Lab--
Walking Dead--
Wishbone--
Wish--
Words2--
World Craft Dream Island--
Wowcher--
YouCamMakeup--
YouTube--
ZEDGE--
Zoopla--
Lipp--
Free Music--
M&S--
Nectar--
Free Music Play--
FreeMusic--
Clash of Clans--
X Factor--
eBay--
hungryhouse--
iDownloads+--
iMusic--
iPlayer Radio--
iScanner--
musical.ly--
tubidy--