Note that on December 21, 2016, Apple put up a developer blog post that said they are delaying enforcement of ATS requirements:
Supporting App Transport Security
December 21, 2016
App Transport Security (ATS), introduced in iOS 9 and OS X v10.11, improves user security and privacy by requiring apps to use secure network connections over HTTPS. At WWDC 2016 we announced that apps submitted to the App Store will be required to support ATS at the end of the year. To give you additional time to prepare, this deadline has been extended and we will provide another update when a new deadline is confirmed. Learn more about ATS.
Starting sometime in 2017, Apple will require justification for adding exceptions to App Transport Security (ATS) in the app’s info.plist file. Tapjoy’s SDK needs to be able to connect to localhost in order to show preloaded content. In the past, this has required adding an ATS exception to the info.plist file.
Fortunately, Apple has introduced a new key for iOS 10, NSAllowsLocalNetworking, which is equivalent to adding an exception for “localhost” and will not require justification during app review. However, this key only works for iOS 10. In order for publishers to support iOS 9, they will need to continue using the older ATS exception key. The documentation from Apple states that the correct way to cover both iOS 9 and 10 is to include both NSAllowsLocalNetworking and NSAllowsArbitraryLoads. In iOS 10, the presence of NSAllowsLocalNetworking will cause the system to ignore the other flag. The presence of NSAllowsArbitraryLoads allows Tapjoy preloading to work on iOS 9.
To work properly on both iOS 9 and 10, Tapjoy applications should include the following keys in their info.plist file:
<key>NSAppTransportSecurity</key> <dict> <!--To support localhost --> <key>NSAllowsLocalNetworking</key> <true/> <!--To continue to work for iOS 9 --> <key>NSAllowsArbitraryLoads</key> <true/> </dict>
Tapjoy has received confirmation from Apple that adding these keys to the info.plist file will not require justification during the submission process. However, if Apple changes its procedures or criteria, we recommend using the following to justify the use ofNSAllowsArbitraryLoads:
We added the NSAllowsArbitraryLoads exception because NSAllowsLocalNetworking isn’t supported in iOS 9.