How to allow all Network connection types HTTP and HTTPS in Android (9) Pie?

Asked 17/8, 2018 at 20:44 Answered 14/12, 2023 at 11:32

Solved java android kotlin android-9.0-pie android-network-security-config

223

From Android 9 Pie now, requests without encryption will never work. And by default, the System will expect you to use TLS by default.You can read this feature here So if you only make requests via HTTPS you are safe. But what about apps that make requests through different sites, for instance, browser-like apps.

How can I enable requests to all types of connections HTTP and HTTPS in Android 9 Pie?

Mckelvey answered 17/8, 2018 at 20:44 Comment(0)

424

The easy way to implement this is to use this attribute to your AndroidManifest.xml where you allow all http for all requests:

<application android:usesCleartextTraffic="true">
</application>

But in case you want some more configurations for different links for instance, allowing http for some domains but not other domains you must provide res/xml/networkSecurityConfig.xml file.

To do this in Android 9 Pie you will have to set a networkSecurityConfig in your Manifest application tag like this:

<?xml version="1.0" encoding="utf-8"?>
<manifest ... >
    <application android:networkSecurityConfig="@xml/network_security_config">




    </application>
</manifest>

Then in your xml folder you now have to create a file named network_security_config just like the way you have named it in the Manifest and from there the content of your file should be like this to enable all requests without encryptions:

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
</network-security-config>

From there you are good to go. Now your app will make requests for all types of connections. For additional information on this topic read here.

Mckelvey answered 17/8, 2018 at 20:44 Comment(10)

@Mckelvey After I made these changes (with a React Native application) it no longer builds. "Manifest merger not successful". "Attribute application@networkSecurityConfig value=(@xml/react_native_config) from AndroidManifest.xml:7:7-67 is also present at AndroidManifest.xml:7:7-67 value=(@xml/network_security_config). Any ideas? – Lieu 28/3, 2019 at 20:47

@Lieu im having same issue as you, did you find any solution? – Flophouse 23/4, 2019 at 23:26

@DanteCervantes check out my answer above. – Rodriguez 25/4, 2019 at 5:12

is the app down listed in the PlayStore if we use the "android:usesCleartextTraffic="true". I know that for the Google Search Engine, it can affect your rank if your website does not provide https access. – Sawfly 26/5, 2019 at 16:30

Where can i find the xml folder in react native project – Pomelo 5/7, 2019 at 3:36

Waste plenty of time figuring out this is actually HTTP issue. normally it shows ERROR on HTTP RESPONSE – Summersault 6/7, 2019 at 8:40

Just add the first statement android:usesCleartextTraffic="true" in your Android Manifest for React Native. @Pomelo – Mckelvey 6/7, 2019 at 9:47

This is not working in case of opening third party link inside webview. Please help – Clower 29/1, 2021 at 6:4

It doest work on api below 23 , not working on lollipop or below device – Equisetum 4/10, 2021 at 15:40

AndroidManifest and network_security_config files are located in React native at android/app/src/main/AndroidManifest.xml android/app/src/main/res/xml/network_security_config.xml – Citole 20/2, 2023 at 11:45

The FULLY WORKING SOLUTION for both Android or React-native users facing this issue just add this android:usesCleartextTraffic="true" in AndroidManifest.xml file like this:

android:usesCleartextTraffic="true"
tools:ignore="GoogleAppIndexingWarning">
<uses-library
    android:name="org.apache.http.legacy"
    android:required="false" />

in between <application>.. </application> tag like this:

<application
      android:name=".MainApplication"
      android:label="@string/app_name"
      android:icon="@mipmap/ic_launcher"
      android:allowBackup="false"
      android:theme="@style/AppTheme"
        android:usesCleartextTraffic="true"
        tools:ignore="GoogleAppIndexingWarning">
        <uses-library
            android:name="org.apache.http.legacy"
            android:required="false" />
      <activity
        android:name=".MainActivity"
        android:label="@string/app_name"/>
 </application>

Rodriguez answered 24/4, 2019 at 16:28 Comment(8)

Wow thanks its working fine in my app ,before its showing i/o failure issue now solved – Shawna 25/4, 2019 at 4:35

if you get tools:ignore error, make sure to add xmlns:tools="http://schemas.android.com/tools" inside your application. Like so <application xmlns:tools="http://schemas.android.com/tools" ... – Bighead 16/5, 2019 at 16:31

I know this is an android question but might help for react-native developers, the ios solution is to add NSAppTransportSecurity to info.plist. #38419498 – Wellbred 27/2, 2020 at 12:11

@HarshitAgrawal I am still unable to download pdf file (having http url) in React Native App. Though, https url are working fine. I have tried adding android:usesCleartextTraffic="true" and uses-library part, but still no luck :( – Yellowhammer 30/9, 2020 at 11:35

@NarendraSingh try to check whether the pdf url is valid or not and also use react-native-fs to access the file system of app to download the pdf. – Rodriguez 8/10, 2020 at 11:4

@HarshitAgrawal Yes, pdf url is valid, I tried with various urls to ensure that. Also, I tried a few other methods and libs including Linking and react-native-file-download, but none of them worked for https url. – Yellowhammer 12/10, 2020 at 12:6

@NarendraSingh which version are you using of react native? – Rodriguez 13/10, 2020 at 8:1

@NarendraSingh check whether it is related to Flipper issue in react native. – Rodriguez 14/10, 2020 at 3:41

A simple way is set android:usesCleartextTraffic="true" on you AndroidManifest.xml

android:usesCleartextTraffic="true"

Your AndroidManifest.xml look like

<?xml version="1.0" encoding="utf-8"?>
<manifest package="com.dww.drmanar">
   <application
       android:icon="@mipmap/ic_launcher"
       android:label="@string/app_name"
       android:usesCleartextTraffic="true"
       android:theme="@style/AppTheme"
       tools:targetApi="m">
       <activity
            android:name=".activity.SplashActivity"
            android:theme="@style/FullscreenTheme">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
       </activity>
    </application>
</manifest>

I hope this will help you.

Sikata answered 22/5, 2019 at 11:20 Comment(1)

I had the same issue on 14th May 2021, with the help of @Mehul Solanki. The problem got fixed. – Alessandro 14/5, 2021 at 17:56

Easy Way

Add usesCleartextTraffic to AndroidManifest.xml

<application
...
android:usesCleartextTraffic="true"
...>

Indicates whether the app intends to use cleartext network traffic, such as cleartext HTTP. The default value for apps that target API level 27 or lower is "true". Apps that target API level 28 or higher default to "false".

Stroganoff answered 20/10, 2019 at 8:45 Comment(1)

Yes easy, but this is the least safe solution. – Laural 29/9, 2022 at 15:51

For React Native applications while running in debug add the xml block mentioned by @Xenolion to react_native_config.xml located in <project>/android/app/src/debug/res/xml

Similar to the following snippet:

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="false">localhost</domain>
        <domain includeSubdomains="false">10.0.2.2</domain>
        <domain includeSubdomains="false">10.0.3.2</domain>
    </domain-config>
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
</network-security-config>

Xray answered 24/4, 2019 at 9:42 Comment(3)

It throws exception on flutter

E/flutter (19798): [ERROR:flutter/shell/common/shell.cc(209)] Dart Unhandled Exception: Invalid argument (domain): Invalid domain name: "localhost", stack trace: #0      new _DomainNetworkPolicy (dart:io/network_policy.dart:85:7)

– Pueblo 20/11, 2020 at 17:23

It's working for me now Thanks ...BTW I'm using React Natice – Tepper 7/1, 2021 at 9:52

This worked for me w/ React Native 60.6, Android 10, Gradle 3.4.3... if running in emulator and you still have issues with connecting to packaging server, try adb reverse tcp:8081 tcp:8081 in your terminal (assuming 8081 is the port metro bundler is running on) – Nutt 13/8, 2021 at 2:53

Just set usesCleartextTraffic flag in the application tag of AndroidManifest.xml file. No need to create config file for Android.

 <application
   android:usesCleartextTraffic="true"
   .
   .
   .>

Niu answered 21/5, 2019 at 10:0 Comment(0)

i got the same problem and i notice that my security config has diferent TAGS like the @Xenolion answer says

<network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">localhost</domain>
    </domain-config>
</network-security-config>

so i change the TAGS "domain-config" for "base-config" and works, like this:

<network-security-config>
    <base-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">localhost</domain>
    </base-config>
</network-security-config>

Pigtail answered 12/11, 2019 at 14:42 Comment(1)

can you please answer this #59117287 – Griffe 3/12, 2019 at 12:8

This worked for me,

add this xml file to: andriod/app/src/main/res/xml/network_security_config.xml

network_security_config.xml

xml/network_security_config.xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">your_domain1</domain>
    </domain-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">your_domain2</domain>
    </domain-config>
</network-security-config>

then add this code to AndroidMenifest.xml

<application
    ...
      android:usesCleartextTraffic="true"
      android:networkSecurityConfig="@xml/network_security_config"
    ...
      >
      <!-- for http support-->
      <uses-library android:name="org.apache.http.legacy" android:required="false"/>
      ...
</application>

Teplitz answered 5/5, 2021 at 13:45 Comment(0)

Add usesCleartextTraffic to AndroidManifest.xml

e.g.

<application
...
android:usesCleartextTraffic="true"
...>

<application
    android: allowBackup="true"
    android:dataExtractionRules="@xml/data_extraction_rules"
    android:fullBackupContent="@xml/backup_rules"
    android:icon="@mipmap/ic_launcher"
    android:label="AndroidLearning"
    android: supportsRtl="true"
    android:UsesCleartextTraffic="true" <-----
    android: theme="@style/Theme.AndroidLearning"
    tools:targetApi="31">
    <activity
    android:name=" MainActivity"
    android:exported="true">
    <intent-filter>
    <action android:name="android. intent.action.MAIN" />
    ‹catedorv android:name="android.intent.catedorv.LAUNCHFR" />

Footfall answered 24/4, 2023 at 15:44 Comment(0)

You may check if you are sending clearText through HTTP Fix : https://medium.com/@son.rommer/fix-cleartext-traffic-error-in-android-9-pie-2f4e9e2235e6
OR
In the Case of Apache HTTP client deprecation (From Google ) : With Android 6.0, we removed support for the Apache HTTP client. Beginning with Android 9, that library is removed from the bootclasspath and is not available to apps by default. To continue using the Apache HTTP client, apps that target Android 9 and above can add the following to their AndroidManifest.xml:

Source https://developer.android.com/about/versions/pie/android-9.0-changes-28

Ferretti answered 6/5, 2019 at 14:6 Comment(0)

For Android 14, I solved the issue only with dart

The idea is to override the HTTP Security Context for the entire application.

Step 1: implement CustomHttpOverrides class which extend the default dart HttpOverrides class

import 'dart:io';

// extend `HttpOverrides` class
class CustomHttpOverrides extends HttpOverrides{
  @override
  HttpClient createHttpClient(SecurityContext? securityContext){
    return super
        .createHttpClient(securityContext)
        ..badCertificateCallback =
                        (X509Certificate certificate, String hostName, int hostPort)=> true;
  }
}

Step 2: Override the default dart HttpOverrides class with the CustomHttpOverrides in the main() method within the main.dart file

void main() {
  HttpOverrides.global = CustomHttpOverrides();
  runApp(const MyApp());
}

Use cases: In the Android Emulator you can access your services / API's running on your local machine via http and https protocols simply by send the http requests to 10.0.2.2 just like:

http://10.0.2.2:<port>/endpoint

https://10.0.2.2:<port>/endpoint

practice example

I have a web API implemented with C#, .NET 8 running on local machine with this http launch settings:

For https requests I have the port 1000 and for http requests I have the port 5197

To be able to send http requests to my API endpoints, I have temporarily disabled the Https Redirection:

// app.UseHttpsRedirection();

To fetch data from the Android Emulator, I attempted to send requests from Chrome to my endpoint:

Using HTTP: http://10.0.2.2:5197/contracts/retrieve-contracts

Using HTTPS: https://10.0.2.2:1000/contracts/retrieve-contracts

To send the http requests from a Flutter application:

// HTTP request
Response responseViaHttp = 
http.get(Uri.parse('http://10.0.2.2:5197/contracts/retrieve-contracts'))
as http.Response;

// HTTPS request
Response responseViaHttps =
http.get(Uri.parse('https://10.0.2.2:1000/contracts/retrieve-contracts'))
as http.Response;

Useful links:

HttpOverrides class

SecurityContext class

Android Emulator networking

Moynahan answered 14/12, 2023 at 11:32 Comment(0)

Hot tags

Godot Unity Godot Help Programming Godot 4.X GUI GDScript 3D 2D Physics CSharp Godot 3.X VR XR Projects C++

For Android 14, I solved the issue only with dart

The idea is to override the HTTP Security Context for the entire application.

practice example

Useful links:

Recommended topics

Hot tags