In the end, your build.settings will need an exception added like so:
settings =
{
iphone =
{
plist =
{
NSAppTransportSecurity =
{
NSExceptionDomains =
{
["example.com"] =
{
NSIncludesSubdomains = true,
NSThirdPartyExceptionAllowsInsecureHTTPLoads = true
},
},
},
},
},
}
If you control the domain, you should use NSExceptionAllowsInsecureHTTPLoads rather than NSThirdPartyExceptionAllowsInsecureHTTPLoads. Only use NSIncludesSubdomains if you need to allow multiple subdomains.
Of course, the ideal solution is to ensure any webview is connecting via a valid https connection... but that is not always possible.