What exactly does App Transport Security block, which Info.plist keys unlock what, and what do you see when it blocks a request?

Predict first

Which Info.plist keys unlock which URLs in a simulator app? (needs a booted iPhone simulator)

import Foundation

func sh(_ args: [String], input: String? = nil) -> (Int32, String) {
    let p = Process(); p.executableURL = URL(fileURLWithPath: "/usr/bin/env"); p.arguments = args
    let out = Pipe(); p.standardOutput = out; p.standardError = Pipe()
    try! p.run()
    let data = out.fileHandleForReading.readDataToEndOfFile()
    p.waitUntilExit()
    return (p.terminationStatus, String(decoding: data, as: UTF8.self))
}
let dir = FileManager.default.temporaryDirectory.appendingPathComponent("ats\(getpid())")
try FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
let app = dir.appendingPathComponent("T.app")
try FileManager.default.createDirectory(at: app, withIntermediateDirectories: true)
let src = dir.appendingPathComponent("t.swift")
try """
import Foundation
for s in CommandLine.arguments.dropFirst() {
    var r = URLRequest(url: URL(string: s)!); r.timeoutInterval = 5
    let sem = DispatchSemaphore(value: 0)
    URLSession.shared.dataTask(with: r) { _, _, e in print(s, (e as NSError?)?.code ?? 0); sem.signal() }.resume()
    sem.wait()
}
""".write(to: src, atomically: true, encoding: .utf8)
let sdk = sh(["xcrun", "--sdk", "iphonesimulator", "--show-sdk-path"]).1.trimmingCharacters(in: .whitespacesAndNewlines)
let build = sh(["swiftc", "-sdk", sdk, "-target", "arm64-apple-ios17.0-simulator", "-swift-version", "5", src.path, "-o", app.appendingPathComponent("T").path])
print("built:", build.0 == 0)
let booted = sh(["xcrun", "simctl", "list", "devices", "booted"]).1
let device = booted.range(of: "[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}", options: .regularExpression).map { String(booted[$0]) }!
let base: [String: Any] = ["CFBundleExecutable": "T", "CFBundleIdentifier": "test.ats14", "CFBundleName": "T", "CFBundlePackageType": "APPL", "CFBundleVersion": "1", "CFBundleShortVersionString": "1", "MinimumOSVersion": "17.0", "CFBundleSupportedPlatforms": ["iPhoneSimulator"], "UIDeviceFamily": [1]]
let cases: [(String, [String: Any])] = [
    ("no ATS keys", [:]),
    ("allow arbitrary loads", ["NSAllowsArbitraryLoads": true]),
    ("exception example.invalid", ["NSExceptionDomains": ["example.invalid": ["NSExceptionAllowsInsecureHTTPLoads": true]]]),
    ("exception + subdomains", ["NSExceptionDomains": ["example.invalid": ["NSExceptionAllowsInsecureHTTPLoads": true, "NSIncludesSubdomains": true]]]),
    ("local networking only", ["NSAllowsLocalNetworking": true]),
]
print("codes: -1022 blocked by ATS, -1003 passed ATS (no such host), -1004 passed ATS (connection refused)")
for (name, ats) in cases {
    var plist = base
    if !ats.isEmpty { plist["NSAppTransportSecurity"] = ats }
    try PropertyListSerialization.data(fromPropertyList: plist, format: .xml, options: 0).write(to: app.appendingPathComponent("Info.plist"))
    _ = sh(["codesign", "-f", "-s", "-", app.path])
    _ = sh(["xcrun", "simctl", "uninstall", device, "test.ats14"])
    _ = sh(["xcrun", "simctl", "install", device, app.path])
    let out = sh(["xcrun", "simctl", "launch", "--console-pty", "--terminate-running-process", device, "test.ats14",
                  "http://example.invalid/", "http://www.example.invalid/", "http://127.0.0.1:1/"]).1
    let codes = out.components(separatedBy: .newlines).filter { $0.hasPrefix("http") }.map { $0.split(separator: " ").last! }
    print(name + ":", codes.joined(separator: " "))
}
_ = sh(["xcrun", "simctl", "uninstall", device, "test.ats14"])
try? FileManager.default.removeItem(at: dir)

• built: true / no ATS keys: -1022 -1022 -1004 / allow arbitrary loads: -1003 -1003 -1004 / exception example.invalid: -1003 -1022 -1004 / exception + subdomains: -1003 -1003 -1004 / local networking only: -1022 -1022 -1004
• no ATS keys: -1003 -1003 -1004 / exception example.invalid: -1003 -1003 -1004
• allow arbitrary loads: -1022 -1022 -1022