2

my program takes an URL from the user, so it may make request to any website of the internet. I'm trying to make this possible, I looked up all the answers about "Android HTTP Cleartext" errors, and made this, but it still doesn't let me connect my test local PHP server, what am I missing here?

<uses-permission android:name="android.permission.INTERNET" />
...
<application
...
android:usesCleartextTraffic="true"
android:networkSecurityConfig="@xml/network_security_config"
tools:ignore="UnusedAttribute"

My security config:

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">api.example.com</domain>
    </domain-config>
</network-security-config>

Thanks!

ALZ
  • 59
  • 2
  • 8
  • Unless your test local PHP server is `api.example.com` or a sub-domain of that, your network security configuration will be ignored. – CommonsWare May 14 '21 at 17:44
  • @CommonsWare But how can I make this to connect every website without any error? Now I can change api.example.com to 192.168.1.21[:8000], but not for all websites in the world. – ALZ May 14 '21 at 17:56
  • In that cas, you should remove android:networkSecurityConfig="@xml/network_security_config". – Edouard Amosse May 14 '21 at 18:00

1 Answers1

6

Try changing your network_security_config.xml as follows:

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="true"></base-config>
</network-security-config>
CSmith
  • 13,318
  • 3
  • 39
  • 42
  • Note that [the default for `cleartextTrafficPermitted` is `false` for apps with `targetSdkVersion` set to 28 or higher](https://developer.android.com/training/articles/security-config?hl=en#base-config). So, your "or" sentence is unlikely to be correct for any app being distributed on the Play Store. Your `` recommendation should work, though. – CommonsWare May 14 '21 at 18:05
  • Thanks @CommonsWare!, I will edit my answer – CSmith May 14 '21 at 18:08