Skip to content

Provide better error messages about disabled insecure HTTP connections #69685

Closed
Closed
Provide better error messages about disabled insecure HTTP connections#69685
Labels
P1High-priority issues at the top of the work lista: error messageError messages from the Flutter frameworka: qualityA truly polished experienced: api docsIssues with https://api.flutter.dev/found in release: 1.23Found to occur in 1.23platform-androidAndroid applications specificallyplatform-iosiOS applications specificallyteam-androidOwned by Android platform teamtriaged-androidTriaged by Android platform team

Description

@tvolkert
tvolkert
opened on Nov 3, 2020

Context:
https://flutter.dev/docs/release/breaking-changes/network-policy-ios-android
https://medium.com/flutter-community/solving-the-new-https-requirements-in-flutter-7abe240fbf23

Can we update the error message to include the fix? Instead of just saying that HTTP is blocked, we could tell people to either a) replace the URL with an HTTPS connection or b) enable HTTP (with all the caveats)

This is the kind of friction point that we can easily mitigate.

Activity

  1. tvolkert
    added
    platform-androidAndroid applications specifically
    platform-iosiOS applications specifically
    a: qualityA truly polished experience
    documentation
    a: error messageError messages from the Flutter framework
    P1High-priority issues at the top of the work list
    found in release: 1.23Found to occur in 1.23
    on Nov 3, 2020

  2. tvolkert commented on Nov 3, 2020

    @tvolkert
    tvolkert
    on Nov 3, 2020
    ContributorAuthor

    @mehmetf can we fix this before the next stable cut?

  3. tvolkert commented on Nov 3, 2020

    @tvolkert
    tvolkert
    on Nov 3, 2020
    ContributorAuthor

    FYI @timsneath

  4. mehmetf commented on Nov 3, 2020

    @mehmetf
    mehmetf
    on Nov 3, 2020
    Contributor

    Possible things we can do:

    • Include a link in the error message that explains all this such as: https://flutter.dev/docs/release/breaking-changes/network-policy-ios-android. I think embedding all this information in the error message itself is likely too much. I can push this through.

    • We can consider changing the Flutter Android embedding to add 10.0.2.2 to the list of allowed addresses. I would not want to do this because it would mean release apps are also allowed to connect to this address and that's not good.

    • We could change the flutter tooling to add android:usesCleartextTraffic="true" automatically to debug AndroidManifest.xml so users don't run into issues while debugging. I am not sure how feasible it is but I have seen similar code changes to tooling for iOS 14 that required additional plist attributes for debugging. I don't have bandwidth to do this unfortunately.

  5. mehmetf
    self-assigned this
    on Nov 3, 2020
  6. pedromassangocode
    added
    passed first triage
    on Nov 5, 2020

  7. mehmetf commented on Nov 7, 2020

    @mehmetf
    mehmetf
    on Nov 7, 2020
    Contributor

    I have opened a PR to update the main article. Right now, the #1 google hit when someone searches this error message + flutter is https://flutter.dev/docs/release/breaking-changes/network-policy-ios-android.

    It is unlikely that we can provide a 2-3 sentence solution. It will be more confusing. For instance, in most cases, HTTPS is not feasible. What if I just want to debug something? What if I am trying to connect to my local server? Allowing all cleartext traffic has serious caveats that won't fit to an error message. For instance, Apple might reject your app.

    I am all for lower friction but it doesn't feel like we can do much else here. If you have an exact error message in mind, happy to hear it :)

  8. timsneath commented on Nov 8, 2020

    @timsneath
    timsneath
    on Nov 8, 2020 via email

  9. mehmetf commented on Nov 9, 2020

    @mehmetf
    mehmetf
    on Nov 9, 2020
    Contributor

    Upstream Dart CL open for this: https://dart-review.googlesource.com/c/sdk/+/171020

  10. 17 remaining items

  11. tvolkert commented on Oct 22, 2021

    @tvolkert
    tvolkert
    on Oct 22, 2021
    ContributorAuthor

    @zanderso is the current status that insecure network connections are disabled with no way to enable them -- and that we want to allow app-level overrides by plumbing through platform-native configuration directives (such as android:usesCleartextTraffic for Android)?

    If so, I propose we close this bug (since the error messages have been improved) and open bugs for Android and iOS.

  12. zanderso commented on Oct 23, 2021

    @zanderso
    zanderso
    on Oct 23, 2021
    Member

    Further platform specific plumbing is needed, yes. It would need to toggle the engine flag here:

    https://github.com/flutter/engine/blob/b71a2fd8f50ecd66b7e65192ef3077a7d0d76f52/common/settings.h#L144

    At the moment, the default value of the flag allows insecure connections to any domain. Internal tooling may override that default, but I don't have a pointer to that code handy.

    However, to clarify, when insecure connections are disabled, the check can be bypassed by setting #flutter.io.allow_http to true in a Zone that will be active while setting up the connection. The check is also not done for connections to localhost. The logic is here:

    https://github.com/flutter/engine/blob/master/lib/ui/hooks.dart#L233

  13. aam commented on Oct 24, 2021

    @aam
    aam
    on Oct 24, 2021
    Member

    At the moment, the default value of the flag allows insecure connections to any domain. Internal tooling may override that default, but I don't have a pointer to that code handy.

    external engine flag disallow-insecure-connections with default value is defined here https://github.com/flutter/engine/blob/b71a2fd8f50ecd66b7e65192ef3077a7d0d76f52/shell/common/switches.h#L192

    flipped over from "disallow" to may_insecurely_connect_to_all_domains for internal use here:
    https://github.com/flutter/engine/blob/b71a2fd8f50ecd66b7e65192ef3077a7d0d76f52/shell/common/switches.cc#L261

  14. aam commented on Feb 24, 2023

    @aam
    aam
    on Feb 24, 2023
    Member

    @tvolkert wrote

    the current status that insecure network connections are disabled with no way to enable them -- and that we want to allow app-level overrides by plumbing through platform-native configuration directives (such as android:usesCleartextTraffic for Android)?
    ...the error messages have been improved...

    @zanderso wrote

    Further platform specific plumbing is needed, yes.

    That's the current state of things.

  15. aam
    removed their assignment
    on Feb 24, 2023
  16. flutter-triage-bot
    added
    d: api docsIssues with https://api.flutter.dev/
    on Jul 5, 2023
  17. Hixie
    removed
    documentation
    on Jul 5, 2023
  18. flutter-triage-bot
    added
    multiteam-retriage-candidate
    team-androidOwned by Android platform team
    triaged-androidTriaged by Android platform team
    on Jul 8, 2023
  19. Hixie
    removed
    passed first triage
    on Jul 8, 2023

  20. gmackall commented on Sep 28, 2023

    @gmackall
    gmackall
    on Sep 28, 2023
    Member

    From Android triage: It looks like the error messages themselves have been fixed, which is what the original issue was about.

    At this point any follow up work for platform-specific plumbing should be filed as a separate issue. Please feel free to re-open if you disagree!

  21. gmackall
    closed this as completedon Sep 28, 2023

  22. github-actions commented on Oct 12, 2023

    @github-actions
    github-actionsbot
    on Oct 12, 2023

    This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.

  23. github-actions
    locked as resolved and limited conversation to collaborators on Oct 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    P1High-priority issues at the top of the work lista: error messageError messages from the Flutter frameworka: qualityA truly polished experienced: api docsIssues with https://api.flutter.dev/found in release: 1.23Found to occur in 1.23platform-androidAndroid applications specificallyplatform-iosiOS applications specificallyteam-androidOwned by Android platform teamtriaged-androidTriaged by Android platform team

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions