Connect version 4.20 broke local http access?

So my health monitoring has just been deliberately broken then, with no warning? We use this to connect to another app on localhost, and there's really no benefit encrypting traffic there. Do android app authors even have any reasonable way to put a valid certificate on localhost?

Horsetooth, thanks very much for tracking this down.

So my health monitoring has just been deliberately broken then, with no warning? We use this to connect to another app on localhost, and there's really no benefit encrypting traffic there. Do android app authors even have any reasonable way to put a valid certificate on localhost?

Horsetooth, thanks very much for tracking this down.

They have never implemented that threat. HTTP was working quite fine with iOS as well as Android. Untill GCM 4.20 at least.

There are a lot of discussions online about excluding ATS for localhost, eg: https://bencoding.com/2015/07/20/app-transport-security-and-localhost/

It also seems Apple backed off from the hard https requirement in 2017?

This will also have broken IoT stuff.

What is the recommended way to do inter-app communication now?

I've read it, but it doesn't mean a whole lot to me since it takes about ats which appears to be apple specific and it's also 2 years old talking about something that was supposed to happen 2 years ago. As I said we've been using localhost on iOS and Android every since then without issue, and every other browser and watch in the world still allows it, fwiw.

Read the 2017 blog post.  This started due to Apple and iOS9

btw, I also consider the 8 word official response from Garmin to be insufficient, in case anyone cares, this is the official bug report channel, is it not?