Android 7.0 intorduced Network Security Config to support use custom CAs, but how Cordova support that? I can not find any hint from docs of Cordova.
3 Answers
You can achieve this by adding the edit-config tag to the Android platform in your config.xml, this is supported by Cordova Android Plugin v7.0.
You will need to create the Network Security Config file that you would create for a native Android application using the examples from Google.
Next in the Cordova config.xml you can use the edit-config tag to add the networkSecurityConfig attribute to the Application tag. Then you just need to copy the Network Security Config file as a resource for your application to the res/xml directory.
Here is an example of how this might look in your applications config.xml
...
<platform name="android">
<edit-config xmlns:android="http://schemas.android.com/apk/res/android" file="app/src/main/AndroidManifest.xml" mode="merge" target="/manifest/application">
<application android:networkSecurityConfig="@xml/network_security_config" />
</edit-config>
<resource-file src="network_security_config.xml" target="app/src/main/res/xml/network_security_config.xml" />
</platform>
...
-
2create the network_security_config.xml file at the root (same with config.xml path), and fill with this: ` <?xml version="1.0" encoding="utf-8"?> <network-security-config> <base-config cleartextTrafficPermitted="true"> <trust-anchors> <certificates src="system" /> </trust-anchors> </base-config> </network-security-config> `– anaAug 28, 2019 at 17:24
-
1or fix the src: <resource-file src="res/xml/network_security_config.xml"...– executorAug 22, 2020 at 4:44
What James answered works but if you have an application where you can't specify a domain or wants to allow clear text traffic for all domains, we need to set android:usesCleartextTraffic="true" in platforms/android/app/src/main/AndroidManifest.xml in <application> tag.
Because, in Android P (version 9, API level 28), cleartext support is by default disabled. To achieve this, just add the following in your config.xml inside <platform name="android">:
<edit-config file="app/src/main/AndroidManifest.xml" mode="merge" target="/manifest/application">
<application android:usesCleartextTraffic="true" />
</edit-config>
-
this is not work to me then i change to
android:cleartextTrafficPermitted="true"still does not work, any one can help ?– anaJul 22, 2019 at 4:57 -
@ana You can add this to your security config xml file for Android. ex.
<domain-config cleartextTrafficPermitted="true"> <domain includeSubdomains="true">akamaihd.net</domain>Aug 9, 2019 at 0:45 -
3I had to add the android namespace definition for this to work:
<edit-config xmlns:android="http://schemas.android.com/apk/res/android" file="app/src/main/AndroidManifest.xml" mode="merge" target="/manifest/application"> <application android:usesCleartextTraffic="true" /> </edit-config>– UilleannOct 2, 2019 at 20:10 -
This should work, but it's not. The easiest possible fix is to lower the sdk version to something <= 27. Example:
<preference name="android-targetSdkVersion" value="27" />, then runcordova prepare android. (Forgot to mention, I'm using cordova-android version 8.0.0)– Lothre1Jan 31, 2020 at 9:26 -
I am using Cordova 11 with android sdk 30. Just using the
<application android:usesCleartextTraffic="true" /> didn't
work for me. XHR Requests to non https urls just reported 'Error'.
I got it working with the following:
In config.xml I added:
<platform name="android">
<edit-config xmlns:android="http://schemas.android.com/apk/res/android" file="app/src/main/AndroidManifest.xml" mode="merge" target="/manifest/application">
<application android:networkSecurityConfig="@xml/network_security_config" />
</edit-config>
<resource-file src="res/xml/network_security_config.xml" target="app/src/main/res/xml/network_security_config.xml" />
</platform>
Contents of res/xml/network_security_config.xml :
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain>10.1.36.67</domain>
</domain-config>
</network-security-config>
Note the use of the local res/xml folder for the network_security_config.xml file. Placing it in the main platform/app directory won't work and will result in the file being overwritten anyway.