{"id":17967880,"url":"https://github.com/simonprickett/cordovacsp","last_synced_at":"2026-04-14T06:33:45.999Z","repository":{"id":149219043,"uuid":"44208813","full_name":"simonprickett/cordovacsp","owner":"simonprickett","description":"Cordova Content Security Policy / iOS 9 ATS Demo App","archived":false,"fork":false,"pushed_at":"2015-10-14T04:24:30.000Z","size":916,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-07-13T00:43:14.307Z","etag":null,"topics":["android-app","content-security-policy","cordova","ios-app","javascript","phonegap","xcode"],"latest_commit_sha":null,"homepage":"https://simonprickett.dev/","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/simonprickett.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-10-13T22:18:25.000Z","updated_at":"2020-04-17T01:19:29.000Z","dependencies_parsed_at":"2023-04-09T22:26:52.739Z","dependency_job_id":null,"html_url":"https://github.com/simonprickett/cordovacsp","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/simonprickett/cordovacsp","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/simonprickett%2Fcordovacsp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/simonprickett%2Fcordovacsp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/simonprickett%2Fcordovacsp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/simonprickett%2Fcordovacsp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/simonprickett","download_url":"https://codeload.github.com/simonprickett/cordovacsp/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/simonprickett%2Fcordovacsp/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31785677,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-14T02:24:21.117Z","status":"ssl_error","status_checked_at":"2026-04-14T02:24:20.627Z","response_time":153,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android-app","content-security-policy","cordova","ios-app","javascript","phonegap","xcode"],"created_at":"2024-10-29T14:09:56.761Z","updated_at":"2026-04-14T06:33:45.980Z","avatar_url":"https://github.com/simonprickett.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cordova Content Security Policy / iOS 9 ATS Demo App\n\n## Introduction\n\nThis is a Cordova 5 app that demonstrates the steps needed to successfully make an Ajax request for data from a server, and how to configure the Content Security Policy meta tag to allow this.\n\nFor iOS 9 / Xcode 7 users this also demonstrates the configuration of App Transport Security (ATS) which by default will block non SSL requests to backend servers.\n\nThe app is very simple, it calls out to an exchange rate API (```http://api.fixer.io```) and aims to tell us the current value of the Euro in US Dollars.  It uses JQuery, but nothing about the Content Security Policy or ATS setup is framework specific - configurations apply to any JS framework.\n\n## Environment Setup\n\n**This project contains iOS specifics, so you will need to build it on a Macintosh.**\n\nYou will need the following installed to be able to use this app properly:\n\n* Cordova CLI 5.3.3 or newer\n* XCode 7 or newer (must be XCode 7 as 6.x doesn't build for iOS 9 and use ATS)\n* Android SDK installed and SDK API level 22 (Android 5.1.1) or higher installed\n* Internet connection\n* Optional: Android emulator configured\n* Optional: Android and iOS device(s)\n\nTo check you have Cordova CLI configured properly, open up a Terminal window on your Mac and type:\n\n```\ncordova -version\n```\n\nYou should expect to see something like:\n\n```\n5.3.3\n```\n\nIf your version doesn't begin with 5, or the cordova binary can't be found then update your Cordova version and Terminal path appropriately.\n\n## Clone and Initial Build\n\nClone the GitHub repo to your Macintosh, then open up a Terminal and cd to wherever you cloned the repo.  To get the app running in the first of three demo states, enter these commands:\n\n```\ncd \u003cfolder where repo was cloned\u003e\ncd app\ncordova platform add ios android\ncordova build ios\ncordova build android\n```\n\nYou should now be able to run the app in the emulators or on your device in the normal way.\n\nWhen first cloned, the app will be in the \"Step 1\" state (broken).\n\n## App States\n\nThere are 3 states, or steps, to this app:\n\n* **Step 1:** Initial out of the box app using default Content Security Policy and ATS configurations that the Cordova CLI uses when creating an app.  This will fail to get the remote data on iOS \u003c 9, iOS 9 and Android because the Content Security Policy meta tag in index.html does not permit it\n* **Step 2:** Here, the Content Security Policy meta tag in index.html has been modified to allow data connections to the API that we are using.  This will work on iOS \u003c 9 and Android, but will continue to fail on iOS 9 because even though we have Cordova configured correctly now, iOS 9 is still blocking our http URL request because the default ATS configuration disallows all non-SSL backends\n* **Step 3:** Here, we have modified the iOS app's .plist (using a Cordova build hook script) to configure an ATS exception allowing non-SSL connections to our API host.  This version of the app will now work on all iOS and Android versions\n\nAfter cloning the repo and following the initial build instructions, you will be at step 1 with a pretty broken app for both Android and iOS.\n\n## Transitioning Between States\n\nWhen first cloned, the app is at step 1 (default Cordova configuration) and will fail to get the data from the API.\n\nTo transition it to step 2 (fixed Content Security Policy meta tag, works on iOS \u003c9 and Android):\n\n```\ncd \u003cfolder where repo was cloned\u003e/app\n./step2.sh\ncordova build ios\ncordova build android\n```\n\nTo then transition to step 3 (fixed Content Security Policy and patches iOS 9 ATS in the project's .plist file - works on all devices):\n\n```\ncd \u003cfolder where repo was cloned\u003e/app\n./step3.sh\ncordova build ios\ncordova build android\n\n```\n\nTo go back to step 1 (not working on iOS \u003c9, 9 or Android):\n\n```\ncd \u003cfolder where repo was cloned\u003e/app\n./step1.sh\ncordova build ios\ncordova build android\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsimonprickett%2Fcordovacsp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsimonprickett%2Fcordovacsp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsimonprickett%2Fcordovacsp/lists"}