# Using non-secure URLs on macOS and iOS

Starting with iOS 9 and OS X 10.11, your apps have to use secure "https" connections or you will get this error: "The resource could not be loaded because the App Transport Security policy requires the use of a secure connection".

This applies to any control that works with HTTP, including: `URLConnection</api/networking/urlconnection>`, `DesktopHTMLViewer</api/user_interface/desktop/desktophtmlviewer>`, and `MobileHTMLViewer</api/user_interface/mobile/mobilehtmlviewer>`.

To continue to connect to non-secure "http" connections that you do not control you'll have to provide a `plist</topics/application_structure/ios/using_a_plist>` with a temporary exception specified for each site you are accessing via http:

``` XML
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>NSAppTransportSecurity</key>
    <dict>
        <key>NSExceptionDomains</key>
        <dict>
            <key>firstsite.com</key>
            <dict>
                <key>NSIncludesSubdomains</key>
                <true/>
                <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
                <true/>
            </dict>
            <key>secondsite.com</key>
            <dict>
                <key>NSIncludesSubdomains</key>
                <true/>
                <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
                <true/>
            </dict>
        </dict>
    </dict>
</dict>
</plist>
```

If you don't know the specific sites, you can request access to everything using a single key:

``` XML
<key>NSAppTransportSecurity</key>
<dict>
  <!-- Include to allow all connections; avoid if possible -->
  <key>NSAllowsArbitraryLoads</key>
      <true/>
</dict>
```

Apple may reject an App Store submission if the app uses these settings without valid reasons.

For more information about this, refer to [NSAppTransportSecurity](https://developer.apple.com/library/ios/documentation/General/Reference/InfoPlistKeyReference/Articles/CocoaKeys.html#//apple_ref/doc/uid/TP40009251-SW33) in Apple's docs.

<div id="/topics/communication/internet/using_non-secure_urls_on_macos_and_ios/see_also">

<div class="seealso">

`URLConnection</api/networking/urlconnection>`, `DesktopHTMLViewer</api/user_interface/desktop/desktophtmlviewer>`, `MobileHTMLViewer</api/user_interface/mobile/mobilehtmlviewer>` classes

</div>

</div>