How do TLS and App Transport Security protect a request, and what is certificate pinning, and why is it fraught?

TLS gives a connection confidentiality, integrity and authentication of the server: the server presents a certificate chain, and the client verifies that it chains to a trusted root, is valid for the host name, has not expired and has not been revoked. App Transport Security (ATS) is Apple’s policy layer: by default URLSession refuses plain HTTP and requires TLS 1.2 or later with strong cipher suites and forward secrecy. You can add exceptions in Info.plist (NSAppTransportSecurity, per domain or globally), but broad exceptions are rejected or questioned in App Review and defeat the point. The validation itself is done by the system’s trust evaluation (SecTrust), and it respects the user’s and organisation’s installed roots.

Certificate pinning goes further: the app only accepts certificates (or, better, public keys) that it knows, so a certificate issued by a compromised or malicious but otherwise trusted authority, or a user-installed proxy root, is rejected. You implement it in the delegate’s urlSession(_:didReceive:completionHandler:) for server-trust challenges (compare the server’s key hash with a stored set), or declaratively with the NSPinnedDomains Info.plist key (iOS 14+), which pins by SPKI hash. It is fraught because it turns a certificate rotation into an outage: if the server’s key changes and your pinned value does not, every installed copy of the app stops connecting until users update. Mitigations: pin the public key of an intermediate or a backup key, not the leaf certificate; ship at least one backup pin that is not yet in use; keep a remote way to disable or update pins (with care, as that itself is an attack surface); monitor expiry; and test the rotation. Pinning is not a defence against a compromised device or a jailbroken one with the runtime hooked (it can be bypassed), so treat it as one layer for high-value APIs, not the whole security story. For most apps, correct TLS and ATS plus short-lived tokens are enough.