NSAllowsArbitraryLoadsInMedia has no effect

Originator:pnixon
Number:rdar://28312964 Date Originated:14-Sep-2016 09:26 PM
Status:Open Resolved:
Product:iOS SDK Product Version:iOS 10.0, iOS 10.0.1
Classification: Reproducible:
 
Patrick Nixon14-Sep-2016 09:26 PM

Summary:
Setting the App Transport Security Setting "NSAllowsArbitraryLoadsInMedia" to "true" does not allow unencrypted requests from AVPlayer, contrary to what the documentation says here:

https://developer.apple.com/library/content/documentation/General/Reference/InfoPlistKeyReference/Articles/CocoaKeys.html#//apple_ref/doc/uid/TP40009251-SW60

An unencrypted HLS playlist will not play even if the underlying media is protected by "secure HLS" encryption.  AVPlayer never even fetches the master playlist, so the existence of HLS encryption is never known to the app anyway.

Also contrary to the documentation, "NSAllowsArbitraryLoadsInMedia" does not cause ATS to ignore the value of "NSAllowsArbitraryLoads".  As far as we can tell, NSAllowsArbitraryLoadsInMedia does nothing.

Steps to Reproduce:
1. Open AllowsArbitraryLoadsInMediaTest.xcodeproj in Xcode 8
2. Run each target in the iOS 10 simulator to try different combinations of ATS settings
3. Note which targets can successfully play the stream, and which cannot.

Expected Results:
All targets that include NSAllowsArbitraryLoadsInMedia should be able to play the stream.

Actual Results:
The NSAllowsArbitraryLoadsInMedia setting has no effect.

Version:
iOS 10.0, iOS 10.0.1

Notes:


Configuration:
iPhone 7 Simulator, iPhone 6s, iPhone 6s Plus, probably others

Attachments:
'AllowsArbitraryLoadsInMediaTest.zip' was successfully uploaded.

Comments

AllowsArbitraryLoadsInMediaTest snippet

//
//  ViewController.swift
//  AllowsArbitraryLoadsInMediaTest
//

import AVFoundation
import UIKit

let bipbopURL = URL(string: "http://devimages.apple.com.edgekey.net/streaming/examples/bipbop_16x9/bipbop_16x9_variant.m3u8")!

class ViewController: UIViewController {
    override func viewDidLoad() {
        super.viewDidLoad()

        let player = AVPlayer()

        let layer = AVPlayerLayer(player:player)
        layer.frame = view.layer.bounds
        view.layer.addSublayer(layer)

        let item = AVPlayerItem(url:bipbopURL)
        player.replaceCurrentItem(with: item)

        player.play()
    }
}
By pnixon at Sept. 15, 2016, 6:39 p.m. (reply...)

Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!