[TIMOB-26377] Android: Allow non-https requests to work when targeting Android P
GitHub Issue | n/a |
---|---|
Type | Improvement |
Priority | Critical |
Status | Closed |
Resolution | Fixed |
Resolution Date | 2018-09-12T21:40:45.000+0000 |
Affected Version/s | n/a |
Fix Version/s | Release 7.5.0 |
Components | Android |
Labels | android, http, httpclient, network, security |
Reporter | Joshua Quick |
Assignee | Joshua Quick |
Created | 2018-09-11T03:55:41.000+0000 |
Updated | 2018-09-24T20:59:56.000+0000 |
Description
*Summary:*
An Android P device will block cleartext "http" requests by default for apps that target Android P.
https://developer.android.com/training/articles/security-config#CleartextTrafficPermitted
The Java Notice that you get a "Cleartext HTTP traffic to
*Note:*
This is also an issue with a
HttpUrlConnection
on Android P will throw the following exception when attempt to do a non-https request...
java.io.IOException: Cleartext HTTP traffic to raw.githubusercontent.com not permitted
*Steps to reproduce:*
Set up "tiapp.xml" to target API Level 28.
Acquire an Android P device that has Internet access.
Build and run [^HttpGetTest.js] on the Android P device.
Tap on the "HTTP Get" button.
Notice that you get a "Cleartext HTTP traffic to not permitted" error.
*Note:*
This is also an issue with a WebView
loading "http:" pages too.
Can be reproduced with the following...
var window = Ti.UI.createWindow();
window.add(Ti.UI.createWebView({ url: "http://www.google.com" }));
window.open();
*Possible Solution:*
Simplest solution may be to set the following "AndroidManifest.xml" <application>
attribute "android:usesCleartextTraffic" to true
for all Titanium built apps by default. This way apps are backward compatible. But allow the Titanium developer to set this to false
in the "tiapp.xml".
https://developer.android.com/guide/topics/manifest/application-element#usesCleartextTraffic
Example...
<manifest>
<application android:usesCleartextTraffic="true"/>
</manifest>
Attachments
File | Date | Size |
---|---|---|
HttpGetTest.js | 2018-09-11T22:57:17.000+0000 | 923 |
PR (master): https://github.com/appcelerator/titanium_mobile/pull/10319
FR Passed. PR Merged.
Verified the fix with sdk 7.5.0.v20180924090601. Works fine.Closing.