苹果是否要求iOS应用使用HTTPS？（2018版规范及当前公开应用问询）

Hey there! Let’s break down your questions clearly, drawing from my years of experience building and submitting iOS apps to the App Store:

1. Did Apple require iOS apps to use HTTPS in the 2018 version of their guidelines? #

Absolutely. Apple first rolled out mandatory HTTPS enforcement via App Transport Security (ATS) in January 2017, following their WWDC 2016 announcement. By 2018, this rule was fully entrenched in their review guidelines.

ATS was enabled by default starting in iOS 9, but 2017 marked the point where non-HTTPS network requests would be blocked by the system unless you added explicit exceptions in your app’s Info.plist file. Even then, those exceptions required a solid justification during review (like accessing a legacy server that couldn’t be upgraded to HTTPS), and Apple was strict about approving only truly necessary cases. So by 2018, HTTPS wasn’t just a best practice—it was a hard requirement for nearly all app network traffic.

2. Does Apple currently require publicly released iOS apps to use HTTPS for all network calls? #

Yes, this requirement is still strictly enforced today, and Apple has even tightened security standards over time:

• ATS remains enabled by default for all new apps. Any non-HTTPS requests will be blocked by iOS unless you’ve submitted a formal exception request (which is rarely approved unless there’s no feasible alternative).
• Apple now mandates a minimum TLS version: apps must support TLS 1.2 or later (TLS 1.3 is strongly recommended for better security and performance).
• HTTPS certificates must also meet modern security criteria (like using robust encryption algorithms) to pass App Store review.

In short, if you’re releasing an app to the App Store today, every network call should use HTTPS. Niche exceptions (e.g., local network communication with devices that don’t support HTTPS) exist but require explicit approval from Apple.

内容的提问来源于stack exchange，提问作者JoeSlav