{"id":44147,"date":"2019-05-17T11:40:55","date_gmt":"2019-05-17T18:40:55","guid":{"rendered":"http:\/\/devblogs.microsoft.com\/xamarin\/?p=44147"},"modified":"2020-04-26T22:23:16","modified_gmt":"2020-04-27T05:23:16","slug":"cleartext-http-android-network-security","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/xamarin\/cleartext-http-android-network-security\/","title":{"rendered":"Managing HTTP & Cleartext Traffic on Android with Network Security Configuration"},"content":{"rendered":"

Did you know that starting with Android 9 (API level 28) cleartext(non-HTTPS) support is disabled by default? It is always recommended to make connections over HTTPS to ensure that any web communication is secure. This policy may have an impact on your development cycle if your app needs to download an image or file on a server hasn’t been configured for HTTPS. Also, you may just be trying to debug your application locally and don’t want to install development certs. You may have strong business requirements that all web traffic on all versions of Android is always HTTPS. This is where the new Network Security Configuration feature of Android comes in, to help us finely tune network traffic security in our app.<\/p>\n

\"\"<\/p>\n

When does Cleartext apply?<\/h2>\n

Cleartext is disabled by default on Android 9 (Pie, API 28) devices when your application is set to target and compile against Android 9. On the project’s properties you will find the SDK you are compiling against under Application:<\/p>\n

\"\"<\/p>\n

Inside of your Android Manifest options you will find the Target Framework that can be set to Android 9:<\/p>\n

\"\"<\/p>\n

Network Security Config<\/h2>\n

To configure security options, you will create a new xml file under Resources\/xml named network_security_config.xml<\/b>. <\/p>\n

\"\"<\/p>\n

The following configuration will enable cleartext web traffic to be allowed in our app for specific domains and IP addresses:<\/p>\n

\r\n<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<network-security-config>\r\n  <domain-config cleartextTrafficPermitted=\"true\">\r\n    <domain includeSubdomains=\"true\">10.0.2.2<\/domain> <!-- Debug port -->\r\n    <domain includeSubdomains=\"true\">xamarin.com<\/domain>\r\n  <\/domain-config>\r\n<\/network-security-config>\r\n<\/code><\/pre>\n
You can strengthen the security of your app by also restricting cleartext traffic on all versions of Android regardless of the compile and target framework. This is accomplished by setting cleartextTrafficPermitted<\/b> to false<\/b>. Enabling this will restrict any traffic that is non-HTTPS at all times.<\/p>\n
Configure Application Manifest<\/h2>\n
The last thing that needs to be done is to configure the networkSecurityConfig<\/b> property on the application<\/b> node in the Android Manifest:<\/p>\n
\r\n<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<manifest>\r\n    <application android:networkSecurityConfig=\"@xml\/network_security_config\">\r\n        ...\r\n    <\/application>\r\n<\/manifest>\r\n<\/code><\/pre>\n
That’s it! Now the application is completely configured to allow or restrict cleartext during web requests.<\/p>\n
Learn More<\/h2>\n
Network security configuration can do a lot more than just allow or restrict cleartext traffic in Android applications. It can configure trust anchors, debug-only overrides, certificate pinning, and more. Be sure to read through the Android developers documentation<\/a> for a full guide. To enable cleartext traffic in iOS applications, you will want to take a look at our App Transport Security(ATS) documentation<\/a> for a full walkthrough. <\/p>\n","protected":false},"excerpt":{"rendered":"
Enhance security by enforcing HTTPS on all of your Android applications web request and easily adjust them for development purposes with Network Security Configuration.<\/p>\n","protected":false},"author":544,"featured_media":44149,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[313,2],"tags":[5251,978],"class_list":["post-44147","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-android","category-developers","tag-http","tag-security"],"acf":[],"blog_post_summary":"
Enhance security by enforcing HTTPS on all of your Android applications web request and easily adjust them for development purposes with Network Security Configuration.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/xamarin\/wp-json\/wp\/v2\/posts\/44147","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/xamarin\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/xamarin\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/xamarin\/wp-json\/wp\/v2\/users\/544"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/xamarin\/wp-json\/wp\/v2\/comments?post=44147"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/xamarin\/wp-json\/wp\/v2\/posts\/44147\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/xamarin\/wp-json\/wp\/v2\/media\/44149"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/xamarin\/wp-json\/wp\/v2\/media?parent=44147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/xamarin\/wp-json\/wp\/v2\/categories?post=44147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/xamarin\/wp-json\/wp\/v2\/tags?post=44147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}