Google Play Pre-launch Reports Security Vulnerability Which Says Cleartext traffic allowed for all domains

Question

Google Play Pre-launch Reports Security Vulnerability Which Says that

Your app's Network Security Configuration allows cleartext traffic for all domains. This could allow eavesdroppers to intercept data sent by your app. If that data is sensitive or user-identifiable it could impact the privacy of your users.

Consider only permitting encrypted traffic by setting the cleartextTrafficPermitted flag to false, or adding an encrypted policy for specific domains. Learn more

network_security_config.xml

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>

    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system"/>
        </trust-anchors>
    </base-config>

    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">127.0.0.1</domain>
    </domain-config>
</network-security-config>

AndroidManifest.xml

 <application
        android:name="com.example.MyActivity"
        android:allowBackup="false"
        tools:replace="allowBackup"
        android:icon="@drawable/ic_launcher"
        android:label="@string/app_name"
        android:largeHeap="true"
        android:theme="@style/AppTheme"
        android:hardwareAccelerated="true"
        android:resizeableActivity="false"
        android:networkSecurityConfig="@xml/network_security_config">

My Doubt is if my give my own domain name domain-config as cleartextTrafficPermitted="true" for example

<domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">http://my-domain.com</domain>
</domain-config>

1. Does it clears my Security Vulnerability issue?
2. I need know wheather if i need to set domain-config for my third party ads networks?

Harts

Check this my answer #54414787 – Angelo

Answer 1

Below the configuration clears Google Play Security Vulnerability

Note:

1. we have use only https urls in android pie
2. To use http in android pie we need to include the domain name in domain-config

<base-config cleartextTrafficPermitted="false">
    <trust-anchors>
        <certificates src="system"/>
    </trust-anchors>
</base-config>

<domain-config cleartextTrafficPermitted="true">
    <domain includeSubdomains="true">myowndomain.com</domain>
</domain-config>

Harts

could you please confirm that to me, I'm using Facebook Ads, and instead of mywondomain.com they use 127.0.0.1, what should I do in this case? – Gyrostabilizer

Answer 2

You have to add an attribute of android:usesCleartextTraffic="true" on application tag in AndroidManifes.xml file.

And also add this.

<uses-library android:name="org.apache.http.legacy" android:required="false"/>

Angelo

This should be a comment, not an answer. – Unhandsome