i am working with Retrofit library on my project, but it seems that Retrofit block non https requests.
I tried by adding in the application tag in Manifest.xml
android:usesCleartextTraffic="true"
but didn't work, i also tried another solution by adding under res/xml a security confing file:
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">http://my subdomain/</domain>
</domain-config>
</network-security-config>
and link it in application tag in the Manifest.xml :
android:networkSecurityConfig="#xml/network_security_config"
both of the solution didn't work.
how can i avoid this error ?
NB: my code works fine when i test with https request, and for testing purposes we are working in a subdomain which use http.
Just was having this exact problem, not sure if the solution for you will be the same. But in my case I was using okhttp3 as my http client, and when building my client I had to specify the connection specs like so:
val specs = listOf(ConnectionSpec.CLEARTEXT, ConnectionSpec.MODERN_TLS)
client.connectionSpecs(specs)
Previously I was only setting MODERN_TLS, so in order to allow my library to accept http connections I had to add the CLEARTEXT spec
You can include urls without specifying http:// for urls. Example of website http://mywebsite.com and ip address http://192.168.1.1, you can write like below:
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">mywebsite.com</domain>
<domain includeSubdomains="true">192.168.1.1</domain>
</domain-config>
</network-security-config>
Related
I need to allow all HTTP for all requests in my code.
The code works fine in debug and release mode for the apk, but it doesn't work when I upload it to Google play as bundle.aab
1- I created network_security_config.xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config cleartextTrafficPermitted="true">
<trust-anchors>
<certificates src="system" />
</trust-anchors>
</base-config>
</network-security-config>
2- add to AndroidManifest/application
<application
android:usesCleartextTraffic="true"
android:networkSecurityConfig="#xml/network_security_config"
......
>
3- add meta-data to application
<application
......>
.....
<meta-data android:name="io.flutter.network-policy"
android:resource="#xml/network_security_config"/>
</application>
4- add the permission
<uses-permission android:name="android.permission.INTERNET"/>
You should https but if you still want to use http protocol then add the following to your Info.plist file in iOS:
<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key>
<true/>
</dict>
Also for android add this entry in AndroidManifest.xml file:
<application
...
android:usesCleartextTraffic="true">
...
</application>
By default, Flutter disables insecure HTTP connections on iOS and Android to improve security and prevent man-in-the-middle attacks. However, if you need to allow insecure HTTP connections for testing or other purposes, you can do so by using the http package's BadCertificateCallback function.
To allow insecure HTTP connections in your Flutter app, you can do the following:
Import the http package and the dart:io library:
import 'package:http/http.dart' as http;
import 'dart:io';
Create a function that returns true for any certificate that should be allowed. For example, the following function allows any certificate:
bool allowInsecureCertificates(X509Certificate cert, String host, int port) {
return true;
}
Use the http.Client constructor and pass the allowInsecureCertificates function as the onBadCertificate parameter to create an HTTP client that allows insecure certificates:
final client = http.Client(onBadCertificate: allowInsecureCertificates);
Use the client to make HTTP requests as needed. For example:
final response = await client.get('http://insecure-server.com/data');
Keep in mind that allowing insecure HTTP connections can compromise the security of your app and the data it handles. It is generally not recommended to allow insecure HTTP connections in production environments. Instead, you should use secure HTTPS connections to protect the integrity and confidentiality of your data.
Is it any specific domain you are trying to call?
You can try adding the <domain-config> tag, if you know which domain you might be using. There is a section on Android documentation, if you want to force the system to use only secure connections here.
But you can try changing some values in that to see if disabling those force items can solve your problem.
Try something like this.
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">network.domain.com</domain>
</domain-config>
</network-security-config>
But this is only for Android.
I developed a Golang API to communicate with my Android app. My API is located on my "server" (currently an old laptop) and I can access my API on my Android device when both are connected on the same network, use the android:usesCleartextTraffic="true" in the manifest and use the IP (192.168.X.XX:XXX) of my server on my Android app. Cool so far :)
But now I want to access using different networks, for this, I created a Dynu account with DDNS with a built-in domain (test.freeddns.org). On my Android log displays:
No Network Security Config specified, using platform default
So I tried using network_security_config.xml:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config xmlns:android="http://schemas.android.com/apk/res/android">
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">test.freeddns.org</domain>
</domain-config>
</network-security-config>
but it gives me the following message:
2022-11-10 12:08:53.518 30659-30745 NetworkSecurityConfig D Using Network Security Config from resource network_security_config debugBuild: true
I tried using the public IP of my server with no success :( I still get the same error
I use the
RequestQueue queue = Volley.newRequestQueue(context); on my Android App to send a POST request to my server.
Any ideas will be more than welcome
Thanks in advance
Best regards
I'm trying to access an IP over HTTP which is defined in application.properties file. How can I access the same in network_security_config without manually changing the file?
Application.properties:
IPv4_1=192.168.19.113
Network Security Config:
<domain includeSubdomains="true">192.168.19.113</domain>
I want to access it as application.properties.IPv4_1 or similar.
I experience the following situation:
Having an HTTP server written in Go using Gin framework and hosted on AWS, only some people (approximately 20%) are able to connect (everyone is connecting from a React Native axios client using an Android device).
The server is located on ec2-3-131-85-255.us-east-2.compute.amazonaws.com:2302. Every request is POST. For example, to register, users access the /register endpoint, http://ec2-3-131-85-255.us-east-2.compute.amazonaws.com:2302/register.
Any hint would be helpful. Thank you in advance.
Most of Android devices doesn't accept http protocol by default so you have to add https
and add this in your manifest application tag
android:networkSecurityConfig="#xml/network_security_config
and add this file to your android
res/xml/network_security_config
and write this inside this file
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">Your URL</domain>
</domain-config>
<base-config cleartextTrafficPermitted="false"/>
</network-security-config>
Maybe some clients are behind a firewall that doesn't allow http requests to ports different than the default (80 for http or 443 for https). You could try to change the port number on which the server listens for requests to port 80.
Currently I am using my httpclient for only http requests, but now i want to use https aswell.
I changed my http URL to a https URL and my application won't connect to the url.
fyi: I can connect with my browser to the https url and get my response just not within my application itself
any ideas what the issue could be or what im doing wrong?
OkHttpClient okHttpClient = new OkHttpClient.Builder()
.connectTimeout(4, TimeUnit.SECONDS)
.build();
retrofit = new Retrofit.Builder()
.baseUrl("https:xyz.com/api/")
.addConverterFactory(GsonConverterFactory.create())
.client(okHttpClient)
.build();
To be able to perform HTTPS connections, an SSL certificate and transport configuration must be present, or your device won't know how to encrypt and more importantly trust the other end.
In short, take a look at the Network Security Configuration official documentation to understand this and what it entails.
If all you care for now is debugging, then you can also find the information on how to "bypass" this for Debugging builds in the same page.
In short (and I quote):
When debugging an app that connects over HTTPS, you may want to connect to a local development server, which does not have the SSL certificate for your production server.
Add a file in res/xml/network_security_config.xml (create it)
Paste something like this (but read what it means and understand it, the security of your app and your user's information is at risk if you don't learn this stuff):
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config>
<trust-anchors>
<certificates src="system" />
</trust-anchors>
</base-config>
<debug-overrides>
<trust-anchors>
<certificates src="user" />
</trust-anchors>
</debug-overrides>
</network-security-config>