Skip to content

Commit 6b43a49

Browse files
committed
fix(ios): remove NSAllowsLocalNetworking so NSAllowsArbitraryLoads is honored
Cleartext gateway probes still failed on a clean Xcode Cloud build despite NSAllowsArbitraryLoads=true. Root cause is a documented ATS rule: on iOS 10+, NSAllowsArbitraryLoads is IGNORED (treated as NO) if NSAllowsLocalNetworking (or the media/web-content variants) is also present. Our plist had both, so ATS stayed enforced and blocked http://<ip>:51821. Drop NSAllowsLocalNetworking; arbitrary loads now actually applies. (Verified on-device the only failing discovery step was the cleartext fetch — Flux API HTTPS already worked.)
1 parent 2d61be1 commit 6b43a49

1 file changed

Lines changed: 4 additions & 3 deletions

File tree

clients/mobile/ios/CumulusVPN/Info.plist

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,12 @@
3434
HTTP (http://<public-ip>:51821) with no TLS/domain, so discovery,
3535
enroll and status are cleartext to public IPs. ATS blocks that unless
3636
arbitrary loads are allowed (domain exceptions don't apply to raw IPs).
37-
The actual VPN traffic is separately encrypted by WireGuard. -->
37+
The actual VPN traffic is separately encrypted by WireGuard.
38+
IMPORTANT: NSAllowsLocalNetworking must NOT be present here — on iOS
39+
10+ its presence makes iOS IGNORE NSAllowsArbitraryLoads (treating it
40+
as NO), which silently re-enables ATS and blocks the cleartext probes. -->
3841
<key>NSAllowsArbitraryLoads</key>
3942
<true/>
40-
<key>NSAllowsLocalNetworking</key>
41-
<true/>
4243
</dict>
4344
<key>RCTNewArchEnabled</key>
4445
<true/>

0 commit comments

Comments
 (0)