Skip to content

fix(swift-ios): allow HTTP connections to NetBird and Tailscale IPs - #10801

Open
DominicVonk wants to merge 1 commit into
pingdotgg:t3code/rebuild-mobile-app-swiftfrom
DominicVonk:fix/swift-ios-http-plist-only
Open

fix(swift-ios): allow HTTP connections to NetBird and Tailscale IPs#10801
DominicVonk wants to merge 1 commit into
pingdotgg:t3code/rebuild-mobile-app-swiftfrom
DominicVonk:fix/swift-ios-http-plist-only

Conversation

@DominicVonk

Copy link
Copy Markdown

What Changed

Aligned the native Swift iOS app with the Expo app by configuring App Transport Security with only NSAllowsArbitraryLoads = true. This replaces the narrower NSAllowsLocalNetworking and ts.net exception configuration.

Why

T3 Code users can connect to arbitrary self-hosted servers over NetBird or Tailscale, including plain HTTP endpoints at 100.* and 10.* addresses or custom hostnames. The app cannot enumerate those destinations ahead of time. Matching the Expo client ensures the Swift client applies one global ATS policy to all user-configured server URLs; keeping NSAllowsLocalNetworking would cause modern iOS versions to ignore NSAllowsArbitraryLoads.

Checklist

  • This PR is small and focused
  • I explained what changed and why
  • No UI changes

Verified by parsing apps/swift-ios/Resources/Info.plist with Python plistlib, checking the ATS dictionary, running git diff --check, and inspecting the Xcode project settings confirming Resources/Info.plist is the app target plist. An Xcode build was not run in this Linux environment.

Created with GPT-6 in the Codex harness.

@github-actions github-actions Bot added vouch:unvouched PR author is not yet trusted in the VOUCHED list. size:S 10-29 changed lines (additions + deletions). labels Sep 8, 2026
@macroscopeapp

macroscopeapp Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The iOS app’s global App Transport Security policy now permits insecure HTTP connections to arbitrary destinations instead of only scoped local and ts.net destinations. This materially broadens the app’s default network security behavior and warrants human review.

You can add or adjust custom eligibility rules. Learn more.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:S 10-29 changed lines (additions + deletions). vouch:unvouched PR author is not yet trusted in the VOUCHED list.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant