Skip to content

fix(levelplay): recommend scoped ATS exceptions only, never NSAllowsArbitraryLoads #81

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ziyiunity merged 2 commits into from
Sep 24, 2026
+7 −34
Merged

fix(levelplay): recommend scoped ATS exceptions only, never NSAllowsArbitraryLoads #81

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2e3565b
fix(levelplay): recommend scoped ATS exceptions only, never NSAllowsA…
ziyiunity Sep 23, 2026
3fbae63
fix(levelplay): recommend no ATS settings and flag the expected valid…
ziyiunity Sep 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 6 additions & 34 deletions skills/levelplay-unity-integration/references/ios-setup.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -290,42 +290,14 @@ LevelPlay SDK requires certain capabilities to function properly:

### App Transport Security (ATS) Configuration

To ensure ads load correctly, configure App Transport Security in your Info.plist:
**No ATS configuration is needed. Leave App Transport Security at its iOS default.** With ATS on, the LevelPlay SDK tells the auction to return secure ads only, so ads load without any `Info.plist` changes.

**Option 1: Allow arbitrary loads (easiest, less secure)**
**Do not add ATS exceptions for ads:**
- **Never set `NSAllowsArbitraryLoads` to `true`.** It turns off transport security for every connection the app makes, including its own backend and login traffic, not just ads, and App Review commonly rejects it without a justification. If the user asks for it, explain this and leave ATS at the default.
- **Don't set `NSAllowsArbitraryLoadsInWebContent` either.** On its own it makes the SDK request insecure ads, which iOS still blocks outside web views.
- **Don't add `NSExceptionDomains` entries for ad networks.** The SDK doesn't read them.

Add this to your Info.plist:
```xml
<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key>
<true/>
</dict>
```

**Option 2: Allow specific domains (more secure)**

If you prefer to only allow specific ad network domains:
```xml
<key>NSAppTransportSecurity</key>
<dict>
<key>NSExceptionDomains</key>
<dict>
<key>ironsrc.com</key>
<dict>
<key>NSIncludesSubdomains</key>
<true/>
<key>NSExceptionAllowsInsecureHTTPLoads</key>
<true/>
</dict>
<!-- Add other ad network domains as needed -->
</dict>
</dict>
```

**Note:** Most ad networks require HTTP access for legacy ad creatives. Without proper ATS configuration, some ads may fail to load.

**When to configure:** Before building for iOS. This can be done in Unity's PostProcessBuild or manually in Xcode after export.
**Expected validation warning:** LevelPlay's integration validation reports "App Transport Security settings MISSING" when these keys are absent. That warning is expected with the default configuration. Don't resolve it by adding `NSAllowsArbitraryLoads`.

### Recommended Xcode Build Settings

Expand Down
1 change: 1 addition & 0 deletions skills/levelplay-unity-integration/references/testing-and-validation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,6 +122,7 @@ real ad networks on device.
**Before running the Test Suite:**
- **Unity Ads is pre-installed** — the Ads Mediation package includes the Unity Ads adapter by default, so you have at least one network ready without any additional setup. For ads to fill on device, verify your LevelPlay dashboard has active instances configured for your ad units.
- **Enable Development Build** in **Build Profiles** (called **Build Settings** in Unity versions before Unity 6) before building to device. Without it, SDK console output won't be visible, making it very difficult to diagnose issues if something doesn't work as expected.
- **Expect an ATS warning on iOS.** Integration validation reports "App Transport Security settings MISSING" when the app uses the default ATS configuration, which is the recommended setup. Ignore it; don't add `NSAllowsArbitraryLoads` to make it go away. See [ios-setup.md](ios-setup.md#app-transport-security-ats-configuration).

## Test Suite Setup

Expand Down
Loading