Applying HTTPS, App Transport Security, and Secure Communication

Course: iOS App Development

Topic: Applying HTTPS, App Transport Security, and Secure Communication

Course Link: iOS Training – JustAcademy

Demo Link: Register for a Course Demo

Website: JustAcademy Official Website

1. Introduction to Secure Communication in iOS

Modern iOS applications frequently communicate with remote servers to retrieve information, authenticate users, upload documents, process payments, and synchronize application data. These communications may contain sensitive information such as usernames, passwords, access tokens, personal details, and financial data.

If network communication is not properly protected, attackers may intercept transmitted information, modify requests, impersonate servers, or steal authentication credentials. Secure communication protects information while it travels between an iOS application and a remote server.

Apple provides several security mechanisms for protecting network connections. HTTPS encrypts communication using TLS, while App Transport Security (ATS) enforces secure networking requirements for supported URL Loading System connections.

Learning Objectives

• Understand HTTP, HTTPS, SSL, and TLS.
• Learn how encryption protects network communication.
• Understand the purpose and working of App Transport Security.
• Configure ATS settings in the iOS application's Info.plist file.
• Make secure API requests using URLSession.
• Understand digital certificates and server trust evaluation.
• Handle networking errors and certificate-related failures.
• Apply secure communication practices in real-world iOS applications.

2. Understanding HTTP and HTTPS

2.1 What Is HTTP?

HTTP stands for Hypertext Transfer Protocol. It is an application-layer protocol used by clients and servers to exchange information over a network.

For example, an iOS application may send an HTTP request to retrieve a list of products from an online shopping server.

A basic HTTP URL looks like this:

http://api.example.com/products

Traditional HTTP communication does not encrypt data at the transport layer. Information transmitted through an unprotected connection may be readable if an attacker successfully intercepts the network traffic.

2.2 What Is HTTPS?

HTTPS stands for Hypertext Transfer Protocol Secure. It uses Transport Layer Security (TLS) to protect communication between a client and a server.

A secure HTTPS URL looks like this:

https://api.example.com/products

HTTPS provides three important security properties:

2.3 HTTP vs HTTPS

3. Understanding SSL and TLS

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are cryptographic protocols designed to secure communication over networks. SSL is an older protocol and is considered obsolete. Modern applications should use TLS.

3.1 What Is TLS?

TLS establishes a secure communication channel between a client and a server. It uses cryptographic algorithms to negotiate security parameters, authenticate the server, and encrypt application data.

3.2 How a TLS Connection Works

1. Client Hello: The client begins the connection and shares supported TLS versions and cryptographic options.
2. Server Hello: The server selects compatible security parameters.
3. Certificate Presentation: The server provides its digital certificate and related identity information.
4. Certificate Validation: The client verifies the certificate chain, validity period, hostname, and trust relationship.
5. Key Establishment: Both sides establish shared session keys using the negotiated key exchange method.
6. Encrypted Communication: Application data is transmitted through the protected TLS connection.

The exact handshake messages differ between TLS versions. Modern TLS implementations use optimized handshakes and strong cryptographic algorithms.

3.3 Why TLS Is Important for iOS Applications

• Protects login credentials and authentication tokens.
• Reduces the risk of network eavesdropping.
• Helps prevent unauthorized modification of transmitted data.
• Verifies the identity of remote servers.
• Supports secure communication with APIs and backend services.

4. Introduction to App Transport Security (ATS)

App Transport Security is an Apple platform security feature that improves privacy and data integrity for network communication. ATS applies secure connection requirements to connections made through Apple's URL Loading System, commonly used through URLSession.

ATS is enabled by default for applications linked against modern Apple SDKs. It requires supported HTTP connections to use HTTPS and applies additional checks to the TLS connection and server credentials.

4.1 Main Responsibilities of ATS

• Encourages encrypted network communication through HTTPS.
• Rejects connections that do not meet applicable security requirements.
• Works with the system's server trust evaluation.
• Helps prevent applications from accidentally communicating through insecure HTTP connections.
• Provides controlled configuration options for exceptional compatibility requirements.

4.2 How ATS Works

When an iOS application makes a request using URLSession, the URL Loading System applies the relevant security policies.

iOS Application
       |
       v
    URLSession
       |
       v
App Transport Security
       |
       v
 TLS Connection Setup
       |
       v
Server Certificate Validation
       |
       v
Secure Remote Server
       |
       v
Encrypted Data Exchange

If the connection violates applicable ATS requirements, the request may fail instead of allowing an insecure connection.

4.3 ATS and URLSession

URLSession is Apple's high-level networking API for transferring data between applications and remote servers. It supports HTTPS and works with ATS automatically for applicable URL Loading System requests.

Example:

import Foundation

let url = URL(string: "https://api.example.com/products")!

let task = URLSession.shared.dataTask(with: url) {
    data, response, error in

    if let error = error {
        print("Network error:", error.localizedDescription)
        return
    }

    guard let httpResponse = response as? HTTPURLResponse else {
        print("Invalid server response")
        return
    }

    guard (200...299).contains(httpResponse.statusCode) else {
        print("HTTP status:", httpResponse.statusCode)
        return
    }

    guard let data = data else {
        print("No response data received")
        return
    }

    print("Received bytes:", data.count)
}

task.resume()

Explanation:

• Foundation provides URLSession and URL networking types.
• URL represents the HTTPS endpoint.
• dataTask creates a network request.
• error contains a transport or request-level failure when one occurs.
• HTTPURLResponse provides the HTTP status code and response metadata.
• task.resume() starts the request.

5. Configuring App Transport Security in Info.plist

The Info.plist file contains configuration information for an iOS application. ATS settings can be added under the NSAppTransportSecurity key when a specific networking configuration is genuinely required.

5.1 Default ATS Configuration

For most applications, no custom ATS configuration is necessary. Leaving ATS enabled by default is the recommended approach.

A basic configuration structure is shown below:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <false/>
</dict>

This explicitly indicates that arbitrary insecure loads are not allowed. In a normal application, this setting is generally unnecessary because the secure default already applies.

5.2 Understanding NSAppTransportSecurity

NSAppTransportSecurity is a dictionary that contains ATS configuration options. It can define specific exceptions or additional security-related behavior.

5.3 Configuring a Domain-Specific Exception

Sometimes an application must communicate with a legacy server that cannot immediately support HTTPS. A narrowly scoped domain exception may be considered temporarily, but the preferred solution is to upgrade the server to support HTTPS.

Example of a domain-specific exception structure:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>legacy.example.com</key>
        <dict>
            <key>NSExceptionAllowsInsecureHTTPLoads</key>
            <true/>
        </dict>
    </dict>
</dict>

Important: This example intentionally demonstrates an insecure exception. It should not be copied into a production application as a normal configuration. Such exceptions weaken transport security, may require justification during App Store review, and should be removed as soon as the server supports secure communication.

6. Making Secure API Requests Using URLSession

Most iOS applications communicate with backend services through REST APIs. URLSession provides a convenient way to make HTTPS requests, submit data, and receive server responses.

6.1 Creating an HTTPS GET Request

A GET request retrieves information from a remote server.

import Foundation

func fetchUserData() {
    guard let url = URL(
        string: "https://api.example.com/users"
    ) else {
        print("Invalid URL")
        return
    }

    let task = URLSession.shared.dataTask(with: url) {
        data, response, error in

        if let error = error {
            print("Request failed:", error.localizedDescription)
            return
        }

        guard let response = response as? HTTPURLResponse,
              (200...299).contains(response.statusCode),
              let data = data else {
            print("Invalid response")
            return
        }

        print("Response received:", data.count)
    }

    task.resume()
}

fetchUserData()

6.2 Creating an HTTPS POST Request

A POST request sends information to a remote server. For example, a login screen may send credentials to an authentication API. Sensitive information should only be sent through HTTPS and should not be written to application logs.

import Foundation

func loginUser() {
    guard let url = URL(
        string: "https://api.example.com/login"
    ) else {
        print("Invalid URL")
        return
    }

    var request = URLRequest(url: url)
    request.httpMethod = "POST"
    request.setValue(
        "application/json",
        forHTTPHeaderField: "Content-Type"
    )

    let credentials: [String: String] = [
        "email": "[email protected]",
        "password": "example-password"
    ]

    do {
        request.httpBody = try JSONSerialization.data(
            withJSONObject: credentials
        )
    } catch {
        print("Unable to encode request:", error)
        return
    }

    URLSession.shared.dataTask(with: request) {
        data, response, error in

        if let error = error {
            print("Login request failed:", error.localizedDescription)
            return
        }

        guard let response = response as? HTTPURLResponse else {
            print("Invalid response")
            return
        }

        print("HTTP status:", response.statusCode)
    }.resume()
}

loginUser()

Security note: The sample credentials are placeholders for learning. Real applications should collect credentials securely, avoid hardcoded secrets, use appropriate authentication flows, and never print passwords or tokens to logs.

6.3 Using URLRequest for Better Control

URLRequest allows developers to configure HTTP methods, request headers, timeouts, and request bodies.

var request = URLRequest(
    url: URL(string: "https://api.example.com/profile")!
)

request.httpMethod = "GET"
request.timeoutInterval = 30
request.setValue(
    "application/json",
    forHTTPHeaderField: "Accept"
)

Using a URL beginning with https:// allows URLSession to establish a TLS-protected connection when the server is correctly configured.

7. Understanding Digital Certificates

A digital certificate is an electronic document used to establish the identity of a server. HTTPS servers present certificates during TLS connection establishment.

7.1 What Is an SSL/TLS Certificate?

A TLS certificate commonly contains the server's domain name, public key, certificate issuer, validity period, and digital signature.

7.2 Certificate Validation

When an iOS application connects to an HTTPS server, the system performs server trust evaluation. This helps determine whether the server certificate can be trusted.

7.3 Certificate Authorities

A Certificate Authority (CA) is an organization trusted to issue or sign digital certificates. A server certificate normally forms part of a certificate chain that leads to a trusted root certificate.

For example:

Trusted Root Certificate
          |
          v
Intermediate Certificate
          |
          v
Server Certificate
          |
          v
api.example.com

The operating system uses the certificate chain and other validation rules to determine whether the server identity can be trusted.

8. Server Trust Evaluation in URLSession

URLSession normally performs server trust evaluation automatically. Developers should generally allow the system to handle certificate validation instead of writing custom trust-handling code.

8.1 Understanding Authentication Challenges

URLSession may notify its delegate when the server presents authentication information. A server trust challenge can be received through the URLSessionDelegate authentication-challenge method.

8.2 Example: Handling a Server Trust Challenge Safely

The following example demonstrates the recommended principle of allowing the system's default handling to evaluate the server trust.

import Foundation

final class SecureSessionDelegate: NSObject,
                                   URLSessionDelegate {

    func urlSession(
        _ session: URLSession,
        didReceive challenge: URLAuthenticationChallenge,
        completionHandler: @escaping (
            URLSession.AuthChallengeDisposition,
            URLCredential?
        ) -> Void
    ) {

        guard challenge.protectionSpace.authenticationMethod
                == NSURLAuthenticationMethodServerTrust else {
            completionHandler(.performDefaultHandling, nil)
            return
        }

        completionHandler(.performDefaultHandling, nil)
    }
}

Explanation:

• The delegate receives an authentication challenge.
• The authentication method is checked.
• Non-server-trust challenges use default handling.
• Server trust is also passed to the system's default handling.
• The application does not blindly accept an unverified certificate.

Do not use .useCredential with a server trust object without correctly evaluating that trust. Blindly accepting certificates can expose the application to man-in-the-middle attacks.

9. Certificate Pinning

Certificate pinning is an additional security technique in which an application checks a server certificate or public key against an expected value that is distributed through a trusted mechanism.

Pinning can help reduce the risk of trusting an unexpected certificate authority or an incorrectly issued certificate. However, it adds maintenance responsibilities and must be implemented carefully.

9.1 Types of Certificate Pinning

9.2 Benefits of Certificate Pinning

• Provides an additional layer of server identity verification.
• Can reduce exposure to certain certificate authority compromise scenarios.
• Helps applications enforce trust in specifically expected server credentials.
• Can be useful for applications with carefully managed security requirements.

9.3 Risks and Limitations

• Incorrect pinning may block legitimate connections.
• Certificate or key rotation can cause application failures if pins are not updated.
• Pinning does not replace normal certificate validation.
• Hardcoded pins require a secure update and backup strategy.
• Custom trust evaluation can accidentally bypass important system checks.

Certificate pinning should be introduced only when the application's threat model justifies it. Use a well-reviewed implementation and maintain backup pins and a rotation plan.

10. Preventing Man-in-the-Middle (MITM) Attacks

A Man-in-the-Middle attack occurs when an attacker positions themselves between two communicating parties and attempts to intercept or modify their communication.

10.1 How a MITM Attack Works

iOS Application
       |
       v
   Attacker
       |
       v
 Remote Server

Possible attacker actions:
- Intercept network traffic
- Attempt to read unencrypted data
- Modify transmitted information
- Impersonate a communication endpoint

10.2 Common Causes of MITM Vulnerabilities

• Using unencrypted HTTP connections.
• Accepting invalid or untrusted certificates.
• Disabling certificate validation.
• Using weak or outdated TLS configurations.
• Trusting unexpected network endpoints.
• Exposing sensitive data through insecure redirects or third-party requests.

10.3 Prevention Techniques

1. Use HTTPS for all remote API endpoints.
2. Keep App Transport Security enabled.
3. Use valid certificates from trusted certificate authorities.
4. Allow the operating system to perform normal server trust evaluation.
5. Never accept every certificate without verification.
6. Protect authentication tokens and sensitive request data.
7. Review third-party SDK network behavior.
8. Test application communication on untrusted networks.

11. Securely Managing API Authentication Tokens

Many applications use access tokens to authenticate API requests. Tokens are sensitive credentials and should be protected both during transmission and while stored on the device.

11.1 Sending an Authorization Header

import Foundation

func fetchProtectedData(token: String) {
    guard let url = URL(
        string: "https://api.example.com/private"
    ) else {
        return
    }

    var request = URLRequest(url: url)
    request.httpMethod = "GET"

    request.setValue(
        "Bearer \(token)",
        forHTTPHeaderField: "Authorization"
    )

    URLSession.shared.dataTask(with: request) {
        data, response, error in

        if let error = error {
            print("Request error:", error.localizedDescription)
            return
        }

        guard let response = response as? HTTPURLResponse else {
            return
        }

        print("Status:", response.statusCode)
    }.resume()
}

11.2 Secure Token Storage

Authentication tokens should not be stored in plain-text files or hardcoded in source code. The iOS Keychain provides a secure mechanism for storing small sensitive values such as credentials and tokens.

Example of storing a token in Keychain:

import Foundation
import Security

func saveToken(_ token: String) -> Bool {
    guard let data = token.data(using: .utf8) else {
        return false
    }

    let query: [String: Any] = [
        kSecClass as String: kSecClassGenericPassword,
        kSecAttrAccount as String: "accessToken",
        kSecValueData as String: data,
        kSecAttrAccessible as String:
            kSecAttrAccessibleWhenUnlockedThisDeviceOnly
    ]

    SecItemDelete(query as CFDictionary)

    let status = SecItemAdd(
        query as CFDictionary,
        nil
    )

    return status == errSecSuccess
}

This example demonstrates a basic Keychain write operation. Production applications should also implement secure retrieval, deletion, update behavior, error handling, and an appropriate access-control policy.

12. Secure Communication Best Practices

12.1 Always Prefer HTTPS

Use HTTPS endpoints for APIs, authentication services, payment systems, and other remote resources. Avoid sending sensitive information through HTTP.

12.2 Keep ATS Enabled

Do not disable ATS globally to fix a server configuration problem. Correct the server's TLS configuration whenever possible.

12.3 Avoid Hardcoded Secrets

Do not store private API keys, passwords, or long-lived credentials directly in Swift source files or application configuration files.

12.4 Validate API Responses

Check network errors, HTTP status codes, response formats, and expected data before using information received from a server.

12.5 Protect Sensitive Logs

Never log passwords, authorization headers, session identifiers, access tokens, or sensitive personal information.

12.6 Use Secure Authentication

Use appropriate authentication standards and short-lived access tokens where practical. Implement token renewal and revocation safely.

12.7 Handle Redirects Carefully

Review redirect behavior so that credentials or sensitive information are not accidentally sent to an unintended destination.

12.8 Keep Dependencies Updated

Update networking libraries and third-party SDKs. Review their security practices and the endpoints to which they transmit application data.

13. Handling HTTPS and ATS Errors

Secure networking may fail when a server has an invalid certificate, an unsupported TLS configuration, an incorrect hostname, or an insecure URL.

13.1 Debugging an ATS Error

1. Identify the exact URL that fails.
2. Check whether the URL uses HTTPS.
3. Review the Xcode console for ATS-related messages.
4. Verify the server certificate and hostname.
5. Check the server's supported TLS configuration.
6. Review the application's Info.plist for unnecessary ATS exceptions.
7. Test the endpoint independently and confirm that the server is configured correctly.

14. Testing Secure Network Communication

Security testing helps developers confirm that an application communicates with trusted servers and protects information during transmission.

14.1 Functional Testing

• Confirm that valid HTTPS requests complete successfully.
• Check that expected API responses are received.
• Verify that invalid requests return appropriate errors.
• Test behavior when the device loses network connectivity.

14.2 Certificate Testing

• Test the application against a server with a valid certificate.
• Check behavior when a certificate is expired.
• Verify hostname mismatch handling.
• Test an untrusted certificate in a controlled environment.

14.3 Network Security Testing

• Inspect requests to confirm that sensitive endpoints use HTTPS.
• Check that credentials are not transmitted through HTTP.
• Review application logs for exposed tokens or personal data.
• Test on public Wi-Fi and other untrusted networks.
• Review redirects and third-party network requests.

14.4 Useful Development Tools

15. Practical Project: Building a Secure API Communication Module

In this practical exercise, you will create a small iOS networking module that communicates with a remote HTTPS API using URLSession.

Project Requirements

• Create a new iOS application in Xcode.
• Use a valid HTTPS API endpoint.
• Create a URLSession-based networking function.
• Send a GET request to retrieve data.
• Handle connection and response errors.
• Validate HTTP status codes.
• Display the received information in the application interface.
• Keep ATS enabled and avoid unnecessary exceptions.

Step 1: Create a Network Manager

import Foundation

final class NetworkManager {

    func fetchData(
        completion: @escaping (Result) -> Void
    ) {

        guard let url = URL(
            string: "https://api.example.com/products"
        ) else {
            completion(.failure(URLError(.badURL)))
            return
        }

        URLSession.shared.dataTask(with: url) {
            data, response, error in

            if let error = error {
                completion(.failure(error))
                return
            }

            guard let response = response as? HTTPURLResponse else {
                completion(.failure(URLError(.badServerResponse)))
                return
            }

            guard (200...299).contains(response.statusCode) else {
                completion(.failure(
                    URLError(.badServerResponse)
                ))
                return
            }

            guard let data = data else {
                completion(.failure(URLError(.zeroByteResource)))
                return
            }

            completion(.success(data))
        }.resume()
    }
}

Step 2: Call the Network Manager

let manager = NetworkManager()

manager.fetchData { result in
    switch result {

    case .success(let data):
        print("Secure response received")
        print("Data size:", data.count)

    case .failure(let error):
        print("Request failed:", error.localizedDescription)
    }
}

Step 3: Verify Secure Communication

1. Run the application on an iOS simulator or physical device.
2. Confirm that the configured API endpoint starts with HTTPS.
3. Check that the server certificate is valid.
4. Confirm that the request succeeds with ATS enabled.
5. Inspect error handling by testing an invalid endpoint.
6. Verify that sensitive information is not exposed in application logs.

Expected Outcome

The application should successfully communicate with a correctly configured HTTPS server, receive the response, and handle connection failures without disabling ATS or bypassing certificate validation.

16. Common Mistakes to Avoid

17. Best Practices Checklist

• Use HTTPS for all ordinary remote API communication.
• Keep App Transport Security enabled.
• Use valid server certificates.
• Allow URLSession to perform default server trust evaluation.
• Avoid broad ATS exceptions.
• Never disable certificate validation to make a request succeed.
• Protect authentication tokens using appropriate storage mechanisms.
• Validate HTTP status codes and response data.
• Do not expose sensitive information in logs.
• Review redirects and third-party SDK network activity.
• Test network failures and certificate errors.
• Keep backend TLS configuration and dependencies updated.

18. Practical Exercises

1. Create a URLSession GET request using an HTTPS API endpoint.
2. Convert the GET request into a POST request with a JSON body.
3. Configure and inspect the application's ATS settings.
4. Test a request against an endpoint with an invalid certificate in a controlled environment.
5. Identify the difference between a certificate expiration error and a hostname mismatch.
6. Implement secure token storage using the Keychain.
7. Inspect API requests and verify that sensitive information is not transmitted through HTTP.
8. Create a reusable NetworkManager class with proper error handling.

19. Interview Questions and Answers

Q1. What is HTTPS?

Answer: HTTPS is HTTP communication protected using TLS. It provides encryption, integrity protection, and server authentication.

Q2. What is App Transport Security?

Answer: ATS is an Apple security feature that enforces secure networking requirements for applicable URL Loading System connections, including HTTPS and TLS-related checks.

Q3. Is ATS enabled by default in iOS applications?

Answer: ATS is enabled by default for applications linked against the relevant modern Apple SDKs. Developers generally do not need to enable it manually.

Q4. What is TLS?

Answer: Transport Layer Security is a cryptographic protocol that protects data exchanged between network clients and servers.

Q5. What is the difference between SSL and TLS?

Answer: SSL is an obsolete predecessor to TLS. Modern applications should use TLS rather than outdated SSL protocols.

Q6. What is a digital certificate?

Answer: A digital certificate is an electronic credential that helps establish a server's identity and associates a public key with that identity.

Q7. What is certificate validation?

Answer: Certificate validation checks whether a server's certificate is trustworthy, valid, correctly signed, and associated with the requested hostname.

Q8. What is a Man-in-the-Middle attack?

Answer: It is an attack in which an attacker attempts to intercept or modify communication between two parties.

Q9. What is certificate pinning?

Answer: Certificate pinning is an additional security technique that checks a server certificate or public key against an expected value.

Q10. What is URLSession?

Answer: URLSession is Apple's networking API for making HTTP and HTTPS requests and transferring data between an application and remote servers.

Q11. Why should developers avoid disabling ATS?

Answer: Disabling ATS can weaken network security and allow connections that do not satisfy the normal security requirements.

Q12. Where should authentication tokens be stored?

Answer: Sensitive tokens can be stored using the iOS Keychain with an access-control policy appropriate to the application's security requirements.

20. Quick Revision

21. Conclusion

HTTPS, App Transport Security, and secure communication are essential parts of modern iOS application development. HTTPS protects information exchanged between an application and its backend, while TLS provides encryption, integrity, and server authentication. ATS strengthens this process by enforcing security requirements for supported URL Loading System connections.

Developers should use URLSession for ordinary HTTP and HTTPS communication, keep ATS enabled, rely on system certificate validation, protect authentication tokens, and avoid unnecessary security exceptions. By following these practices, developers can build iOS applications that communicate more safely and protect users' information against common network threats.

22. Official Learning Resources

• Apple – Preventing Insecure Network Connections
• Apple – NSAppTransportSecurity Documentation
• Apple – Performing Manual Server Trust Authentication
• OWASP – iOS App Transport Security

23. Explore iOS Training at JustAcademy

Learn iOS application development, Swift programming, networking, API integration, application security, and practical project development through structured training.

Explore iOS Training

Register for a Free Course Demo

Visit JustAcademy