Apple introduced the new “Apple Transport Security” feature in iOS9 to restrict apps that use HTTP protocol requests behind the scenes. To allow your app to use HTTP, Apple provides Info.plist settings. This new feature will have an impact on the execution of apps that use HTTP directly or use components and RTL functions that use HTTP behind the scenes. TAppAnalytics and TWebBrowser are two RAD Studio 10 Seattle components that use HTTP. This blog post demonstrates how to configure the new Info.plist options and includes a link to sample source code projects for Delphi and C++Builder in RAD Studio 10 Seattle.
Because the required settings in the Info.plist file use structured data, we cannot change them from the IDE’s Project/Options menu. Users must create a custom Info.plist for their app. There are two ways to modify a custom Info.plist file so that your apps will work properly on devices running iOS 9:
Option 1: Go to the bottom of the file and insert the following text above the last “</dict>” tag:
This will disable Apple’s App Transport Security feature for all HTTP communications used by the application, for example if you use the TWebBrowser or Project Indy’s HTTP component.
Option 2: Go to the bottom of the file and insert the following text above the last “</dict>” tag:
This will create a permitted exception in the App Transport Security to allow non-secure HTTP communications only with the domain appanalytics.embarcadero.com. All other App Transport Security rules remain in place.
Creating a Custom Info.plist for your HTTP-based iOS 9 or OS X apps with one of the above settings (for example, if you use TAppAnalytics or TWebBrowser components in your iOS 9 apps – these use HTTP under the covers)
When you deploy your project, the Info.plist file is regenerated. You must save the file in a different location, such as your project directory. (Note that the 32-bit and 64-bit versions differ slightly.) Changes should be made in the newly saved file before proceeding to the Deployment Manager (Project/Deployment). Check that the configuration is correct and uncheck the Info.plist default. Add the new custom version and ensure that the Remote Name is set to “Info.plist” (case-sensitive). This should be done for both the 64-bit and 32-bit deployments.
Here are my Project | Deployment settings for the projects in my example source code, which you can find on Code Central at http://cc.embarcadero.com/item/30392
TAppAnalytics samples Info.plist settings in Project | Deployment
TWebBrowser sample Info.plist setting in Project | Deployment
App Transport Security Technote
https://developer.apple.com/library/prerelease/ios/technotes/App-Transport-Security-Technote/
“App Transport Security is a feature that improves the security of connections between an app and web services. The feature consists of default connection requirements that conform to best practices for secure connections. Apps can override this default behavior and turn off transport security. Transport security is available in iOS 9.0 or later, and in OS X v10.11 and later.”