Android Studio warning " Setting <base-config cleartextTrafficPermitted="true"/> is not recommended."

Question

I'm integrating PayUMoney with my app. For Android versions above 9 cleartextTrafficPermitted="false" by default. So I get the following error:

The webpage at http://180.179.174.15:3000/pgSimulator/axis/redirect could not be loaded because: net::ERR_CLEARTEXT_NOT_PERMITTED

So in network_security_config.xml, I changed it to true as below:

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="true"/>
</network-security-config>

And now Android Studio shows:

Setting is not recommended.

Now is it safe to set it to false? If I don't set it to false. PayUMoney does not work. So what to do now?

Afloat

You have to add your domain, Check my answer – Rearrange

Does this answer your question? How to allow all Network connection types HTTP and HTTPS in Android (9) Pie? – Nottinghamshire

Just register a host-name & install an SSL certificate, in order to fix this properly... else you are running a payment gateway with plain-text traffic, which is extremely stupid (unless this is only for testing purposes). – Watercool

Answer 1

Either use

<application
    ...
    android:usesCleartextTraffic="true">
    ....
</application>

Or set config like below with domain:

<network-security-config>
  <domain-config cleartextTrafficPermitted="true">
    <domain includeSubdomains="true">Your_domain</domain>
  </domain-config>
</network-security-config>

Rearrange

What is "Your_domain" here? I am using Firebase realtime database for my android app. I don't have any domain. – Afloat

Then just use android:usesCleartextTraffic="true". No need about config – Rearrange

And from your log, probably this is your domain. http://180.179.174.15:3000 – Rearrange

I am sorry to say that putting android:usesCleartextTraffic="true"> in Manifest does not work. It gives me this error- Manifest merger failed : Attribute application@usesCleartextTraffic value=(true) from AndroidManifest.xml:20:9-44 is also present at [com.payu.custombrowser:payu-custom-browser:7.5.1] AndroidManifest.xml:17:18-54 value=(false). Suggestion: add 'tools:replace="android:usesCleartextTraffic"' to <application> element at AndroidManifest.xml:11:5-38:19 to override. – Afloat

Also <network-security-config> <domain-config cleartextTrafficPermitted="true"> <domain includeSubdomains="true">Your_domain</domain> </domain-config> </network-security-config> does not work – Afloat

For the first problem use tools:replace="android:usesCleartextTraffic" in your application tag with android:usesCleartextTraffic="true" – Rearrange

I am sorry to say again that it is not working. I am so thankful for what you did. – Afloat