Cleartext Traffic

Description

Using HTTP or other unencrypted protocols exposes sensitive data to interception and manipulation over the network. Android may still allow cleartext if usesCleartextTraffic is enabled or network security config permits it.

Examples

Detect Cleartext Usage

rg -n "usesCleartextTraffic|cleartextTrafficPermitted" AndroidManifest.xml res/xml/network_security_config.xml

Observe Plain HTTP Requests

tcpdump -i en0 -A host api.example.com and tcp port 80

If credentials/PII appear, transport is insecure.

Remediation

1. Enforce HTTPS

   • Disable cleartext by default; require TLS for all endpoints.

2. Network security config

   • Set cleartextTrafficPermitted="false"; allow exceptions only for known dev hosts.

3. Backend hardening

   • Redirect HTTP to HTTPS; set HSTS and reject insecure ciphers.