title: iOS9 ATS: what about HTML5 based apps?
body: <p>According to the documentation from <a href="https://developer.apple.com/library/content/releasenotes/General/WhatsNewIniOS/Articles/iOS9.html#//apple_ref/doc/uid/TP40016198-SW14" rel="noreferrer">https://developer.apple.com/library/content/releasenotes/General/WhatsNewIniOS/Articles/iOS9.html#//apple_ref/doc/uid/TP40016198-SW14</a>, Apple forces to use HTTPS over HTTP in iOS 9.</p>
  <blockquote>
  <p><strong>App Transport Security</strong></p>
  <p>App Transport Security (ATS) lets an app add a declaration to its Info.plist file that specifies the domains with which it needs secure communication. ATS prevents accidental disclosure, provides secure default behavior, and is easy to adopt. You should adopt ATS as soon as possible, regardless of whether you’re creating a new app or updating an existing one.</p>
  <p>If you’re developing a new app, you should use HTTPS exclusively. If you have an existing app, you should use HTTPS as much as you can right now, and create a plan for migrating the rest of your app as soon as possible.</p>
  </blockquote>
  <p>What does that mean for web applications, esp. Sencha Touch and Cordova/PhoneGap based ones? My web app can be configured to <strong>any</strong> server address, so there's no way I can whitelist them in a plist file. Will this only be applicable for applications that use native requests (via NSURLRequest etc.)?</p>