Disabled TLS Validation (ARCH9119)

Key swift.security.disabled-tls-validation · Severity error · Category security · CWE CWE-295

Flags URLSession delegates that accept any server trust (URLCredential(trust:) for every challenge) and NSAllowsArbitraryLoads-style bypasses set in code.

Incorrect

func urlSession(_ s: URLSession, didReceive c: URLAuthenticationChallenge) async -> (URLSession.AuthChallengeDisposition, URLCredential?) {
    return (.useCredential, URLCredential(trust: c.protectionSpace.serverTrust!))
}

Correct

// evaluate the trust (SecTrustEvaluateWithError) or pin the certificate before accepting

Fix

Evaluate or pin the server trust; never accept unconditionally.