Since Android 9, Android by default only allows network connections over HTTPS. However the only requests i'm doing are done over the localhost (e.g http://10.41.199.226:port/FooBar
) which is handled by a (C#)HttpListener
listening to that address:port combination.
Since this request is made over HTTP Android doesn't by default allow it. Following this documentation by Android about the network_security_config
file I can allow HTTP connections by adding the following network_security_config.xml
file
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config cleartextTrafficPermitted="true">
<trust-anchors>
<certificates src="system" />
<certificates src="user" />
</trust-anchors>
</base-config>
<debug-overrides>
<trust-anchors>
<certificates src="user" />
</trust-anchors>
</debug-overrides>
</network-security-config>
Which is called from the Android manifest using android:networkSecurityConfig="@xml/network_security_config"
.
This allows the HTTP request to be completed, however because this sets the base-config it allows HTTP requests to be made across the entire app. This isn't a good idea seeing I may want to add outgoing requests in the future, which I would want to be over HTTPS and would like this safety net to be in place for that. Making this a no-go.
Further on in that same document they introduce the domain-config
which allows you to set the cleartextTrafficPermitted
depending on the domain, which I tried with the following domains set
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">127.0.0.1</domain>
<domain includeSubdomains="true">10.0.0.1</domain>
<domain includeSubdomains="true">localhost</domain>
</domain-config>
</network-security-config>
With no results, requests were still getting blocked due to not being https.
I looked up the device's local address, and added it to the domains list
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">10.41.199.226</domain> <!--assume this is my local ip -->
</domain-config>
This worked, and HTTP was allowed only when requested over the localhost, while any outgoing request would this require HTTPS.
The only problem with this is is that I have no way of knowing the local ip off the device that'll run the app before the app is launched.
So my question is, is there a way to either:
- Set the domain name to something that'll automatically register as the local ip? (something like
localhost
as I tried, but which didn't work) - Add a "wildcard" IP address that'll accept any IP within the 10.x.x.x range (I had hoped setting
includeSubdomains="true"
would do this for me when adding a10.0.0.0
address. But it doesn't) - As a final resort, is it possible to edit the
network_security_config.xml
file at runtime, so I can dynamically update the domain name of one of the domain entries to the current local ip, when launching the app?
The app is developed using Unity 2019.1.8 using the .net 4.x IL2CPP scripting runtime
from Setting domain name of network_security_config.xml to localhost at runtime
No comments:
Post a Comment