Network Security Configuration for Domain-Specific Cleartext Traffic
0 reputation · 27 Nov 2022, 19:26 UTC
Android 9 (API level 28) and higher enforce HTTPS by disabling cleartext HTTP traffic by default. While global flags like android:usesCleartextTraffic can enable HTTP for all connections, this introduces security vulnerabilities in production environments.
The Network Security Configuration feature allows for granular control by defining separate security policies for debug and release builds. This enables developers to permit cleartext traffic for local development servers while maintaining strict TLS requirements for production endpoints.
There is uncertainty regarding the interaction between these app-level XML configurations and system-level proxy overrides implemented by various OEM manufacturers. It is unclear if a system-level proxy can bypass the cleartextTrafficPermitted="false" constraint defined in the Network Security Configuration.
- Does a system-wide proxy override the app's Network Security Configuration restrictions?
- How does the Android framework prioritize OEM-specific network layers over the
network_security_config.xmlsettings?
android