Skip to content

<base-config> in Network Security Configuration for Android is not honoured & fatal crash when using IP addresses as <domain> #65841

Open
Open
<base-config> in Network Security Configuration for Android is not honoured & fatal crash when using IP addresses as <domain>#65841
Labels
P3Issues that are less important to the Flutter projectc: proposalA detailed proposal for a change to Flutterengineflutter/engine related. See also e: labels.platform-androidAndroid applications specificallyteam-androidOwned by Android platform teamtriaged-androidTriaged by Android platform team

Description

@sarbagyastha
sarbagyastha
opened on Sep 15, 2020

Steps to Reproduce

A) Not honouring <base-config>

  1. Update network_security_config.xml as
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="true"/>
    <domain-config cleartextTrafficPermitted="false">
        <!-- List the domains for which you want ensure HTTPS traffic -->
        <domain>secure.example.com</domain>
        <domain>dev.example.com</domain>
    </domain-config>
</network-security-config>
  1. Set base URL with http scheme. For instance http://10.0.2.2
  2. Run the app.

Expected results:
All the domains & IPs expect example.com & dev.example.com should be allowed to have http scheme.

Actual results:
Insecure socket connections are disallowed by platform: for all domains & IPs

B) Fatal Crash when setting IP addresses as <domain>

  1. Update network_security_config.xml as
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="false"/>
    <domain-config cleartextTrafficPermitted="true">
        <!-- List the domains for which you want opt out ensuring HTTPS traffic -->
        <domain>10.0.2.2</domain>
        <domain>insecure.example.com</domain>
    </domain-config>
</network-security-config>
  1. Set base URL with http scheme. For instance http://10.0.2.2
  2. Run the app.

Expected results:
IPs and domains listed above should be allowed to have http scheme.

Actual results:
image

Activity

  1. sarbagyastha commented on Sep 15, 2020

    @sarbagyastha
    sarbagyastha
    on Sep 15, 2020
    ContributorAuthor

    /cc @mehmetf

  2. sarbagyastha
    changed the title [-]Network Security Configuration in Android is not honouring <base-config> and fatal crash when using IP addresses as <domain>[/-] [+]<base-config> in Network Security Configuration for Android is not honoured and fatal crash when using IP addresses as <domain>[/+] on Sep 15, 2020
  3. sarbagyastha
    changed the title [-]<base-config> in Network Security Configuration for Android is not honoured and fatal crash when using IP addresses as <domain>[/-] [+]<base-config> in Network Security Configuration for Android is not honoured & fatal crash when using IP addresses as <domain>[/+] on Sep 15, 2020

  4. pedromassangocode commented on Sep 15, 2020

    @pedromassangocode
    pedromassangocode
    on Sep 15, 2020

    Hi @sarbagyastha
    Can you please provide your flutter doctor -v, your flutter run --verbose and a minimal complete reproducible code sample and clear steps in how to reproduce this issue?
    Thank you

  5. pedromassangocode
    added
    in triagePresently being triaged by the triage team
    waiting for responseThe Flutter team cannot make further progress on this issue until the original reporter responds
    on Sep 15, 2020

  6. sarbagyastha commented on Sep 15, 2020

    @sarbagyastha
    sarbagyastha
    on Sep 15, 2020
    ContributorAuthor

    @pedromassango I guess the information provided above should be enough as the issue is not at my side, but at the engine itself.

  7. no-response
    removed
    waiting for responseThe Flutter team cannot make further progress on this issue until the original reporter responds
    on Sep 15, 2020

  8. pedromassangocode commented on Sep 15, 2020

    @pedromassangocode
    pedromassangocode
    on Sep 15, 2020

    I don't think so. I'm part of the triage team and without knowing much about the engine I should be able to reproduce the issue from the steps provided by the author.

    For example I'm not sure where to add network_security_config.xml in a Flutter project an where to do this:

    1. Set base URL with http scheme. For instance http://10.0.2.2

    Please provide your flutter run --verbose and a minimal complete reproducible code sample and clear steps in how to reproduce this issue?
    Thank you

  9. pedromassangocode
    added
    waiting for responseThe Flutter team cannot make further progress on this issue until the original reporter responds
    on Sep 15, 2020

  10. sarbagyastha commented on Sep 15, 2020

    @sarbagyastha
    sarbagyastha
    on Sep 15, 2020
    ContributorAuthor

    @pedromassangocode Here the link to the repo with reproducible example

    The configuration xml can be found here.

    Url can be set from here.

    And here is the flutter doctor -v output:

    [✓] Flutter (Channel master, 1.22.0-10.0.pre.178, on Linux, locale en_US.UTF-8)
    • Flutter version 1.22.0-10.0.pre.178 at
      /home/username/Development/flutter_master
    • Framework revision ca2ecf7536 (56 minutes ago), 2020-09-15 10:47:03 -0400
    • Engine revision c6121c5d51
    • Dart version 2.10.0 (build 2.10.0-124.0.dev)

 
[✓] Android toolchain - develop for Android devices (Android SDK version 30.0.0)
    • Android SDK at /home/username/Android/Sdk
    • Platform android-30, build-tools 30.0.0
    • Java binary at: /home/username/Development/android-studio/jre/bin/java
    • Java version OpenJDK Runtime Environment (build
      1.8.0_242-release-1644-b3-6222593)
    • All Android licenses accepted.

[✓] Chrome - develop for the web
    • Chrome at google-chrome

[✓] Linux toolchain - develop for Linux desktop
    • clang version 10.0.0-4ubuntu1
    • cmake version 3.16.3
    • ninja version 1.10.0
    • pkg-config version 0.29.1

[✓] Android Studio (version 4.0)
    • Android Studio at /home/username/Development/android-studio
    • Flutter plugin version 50.0.2-dev.1
    • Dart plugin version 193.7547
    • Java version OpenJDK Runtime Environment (build
      1.8.0_242-release-1644-b3-6222593)

[✓] Connected device (4 available)
    • sdk gphone x86 (mobile) • emulator-5554 • android-x86    • Android 10 (API
      29) (emulator)
    • Linux (desktop)         • linux         • linux-x64      • Linux
    • Web Server (web)        • web-server    • web-javascript • Flutter Tools
    • Chrome (web)            • chrome        • web-javascript • Google Chrome
      84.0.4147.105

• No issues found!
  11. no-response
    removed
    waiting for responseThe Flutter team cannot make further progress on this issue until the original reporter responds
    on Sep 15, 2020
  12. mehmetf
    self-assigned this
    on Sep 15, 2020

  13. mehmetf commented on Sep 15, 2020

    @mehmetf
    mehmetf
    on Sep 15, 2020
    Contributor

    1. <base-config> is not being handled today. That is an issue and we will fix it. For now, you can use https://developer.android.com/guide/topics/manifest/application-element#usesCleartextTraffic to set global policy.

    2. Rejecting IP addresses was a deliberate decision. Android documentation does not ban IP addresses but does not explicitly permit them either. Android also has odd behavior where it is possible to include sub-domains of an IP address which does not make sense. iOS documentation specifically mentions not to use IP addresses:

    image

  14. sarbagyastha commented on Sep 15, 2020

    @sarbagyastha
    sarbagyastha
    on Sep 15, 2020
    ContributorAuthor

    Rejecting IP addresses was a deliberate decision. Android documentation does not ban IP addresses but does not explicitly permit them either. Android also has odd behavior where it is possible to include sub-domains of an IP address which does not make sense. iOS documentation specifically mentions not to use IP addresses

    @mehmetf iOS has NSAllowsLocalNetworking to enable local IPs though. But how are we going to do the same in Android, if IP addresses are being rejected ?

    Let's say I want to permit clear-text traffic only for selected local IPs but enforce https on all domain names. How can i achieve that ?

  15. 18 remaining items

  16. flutter-triage-bot
    removed
    triaged-androidTriaged by Android platform team
    on Jul 8, 2023

  17. flutter-triage-bot commented on Jul 8, 2023

    @flutter-triage-bot
    flutter-triage-botbot
    on Jul 8, 2023

    This issue is assigned but has had no recent status updates. Please consider unassigning this issue if it is not going to be addressed in the near future. This allows people to have a clearer picture of what work is actually planned. Thanks!

  18. Hixie
    removed
    passed first triage
    on Jul 8, 2023
  19. flutter-triage-bot
    added
    ⏳Bot is counting down the days until it unassigns the issue
    on Nov 25, 2023

  20. flutter-triage-bot commented on Nov 25, 2023

    @flutter-triage-bot
    flutter-triage-botbot
    on Nov 25, 2023

    This issue is assigned to @mehmetf but has had no recent status updates. Please consider unassigning this issue if it is not going to be addressed in the near future. This allows people to have a clearer picture of what work is actually planned. Thanks!

  21. flutter-triage-bot
    unassigned
    mehmetf
    on Feb 7, 2024

  22. flutter-triage-bot commented on Feb 7, 2024

    @flutter-triage-bot
    flutter-triage-botbot
    on Feb 7, 2024

    This issue was assigned to @mehmetf but has had no status updates in a long time. To remove any ambiguity about whether the issue is being worked on, the assignee was removed.

  23. flutter-triage-bot
    removed
    ⏳Bot is counting down the days until it unassigns the issue
    on Feb 7, 2024
  24. camsim99
    added
    P3Issues that are less important to the Flutter project
    triaged-androidTriaged by Android platform team
    and removed
    P2Important issues not at the top of the work list
    on Feb 15, 2024
  25. Hixie
    removed
    multiteam-retriage-candidate
    on Mar 6, 2024

  26. aggeloskoutanis commented on Mar 4, 2025

    @aggeloskoutanis
    aggeloskoutanis
    on Mar 4, 2025 · Hidden as duplicate
  27. mboetger
    added 2 commits that reference this issue on Jul 6, 2026

    fix(android): honor <base-config> and allow IP addresses in NetworkSe…

    c48a5f7

    fix(android): honor <base-config> and allow IP addresses in NetworkSe…

    452f6d6
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    P3Issues that are less important to the Flutter projectc: proposalA detailed proposal for a change to Flutterengineflutter/engine related. See also e: labels.platform-androidAndroid applications specificallyteam-androidOwned by Android platform teamtriaged-androidTriaged by Android platform team

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions