Skip to content
Narvy

Cleartext HTTP on Android: blocked by default, allowed by mistake

With targetSdkVersion 28 or higher, Android blocks plain http:// traffic unless the app opts in. Move the endpoint to HTTPS. If one host really has to stay on HTTP, allow it alone in a network security config, never with android:usesCleartextTraffic="true" for every domain, which the store check reports.

Logcat, at runtime (OkHttp)
java.net.UnknownServiceException: CLEARTEXT communication to <host> not permitted by network security policy
Logcat, at runtime (HttpURLConnection)
java.io.IOException: Cleartext HTTP traffic to <host> not permitted

What it means

android:usesCleartextTraffic defaults to true for apps targeting API 27 or lower and to false from API 28. On Android 7.0 and higher, a network security config, when present, takes precedence over the manifest attribute.

This is not a Google Play upload rule, so the store check reports it as a warning: an app that allows cleartext for every domain sends any HTTP request in a form that anyone on the network path can read or modify.

Deadline

No store date. The platform default changed with Android 9 (API 28).

How to fix it

1. Use HTTPS

Change http:// base URLs to https://, including those in remote config, WebView content and third-party SDK settings.

2. If one host must stay on HTTP, allow only that host

res/xml/network_security_config.xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="false" />
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="false">legacy.example.com</domain>
    </domain-config>
</network-security-config>
AndroidManifest.xml
<application
    android:networkSecurityConfig="@xml/network_security_config"
    ... >

3. Remove the global opt-in

Delete android:usesCleartextTraffic="true" and any <base-config cleartextTrafficPermitted="true">. For local development servers, put the exception in a debug-only network security config (src/debug/res/xml/).

Check before you submit

Upload the APK, AAB or split-APK set (XAPK, APKS, APKM) on the store check page. It runs PLAY-CLEARTEXT against the dates on this page, then deletes the file: nothing about the app is kept. The same engine runs offline in the Narvy CLI, and exits with code 1 when a blocker is found, so it can gate a CI job.

Offline, from a terminal (narvy-cli 1.2.0 or later)
narvy store-check app-release.aab

Check a build in the browser

FAQ

Will Google Play reject my app for allowing cleartext?

Not on that ground alone. It is a security weakness, not an upload rule, which is why the store check reports it as a warning and not as a blocker.

Why is my app flagged when I never set usesCleartextTraffic?

Either targetSdkVersion is 27 or lower, where the platform default allows cleartext, or a network security config (yours or a merged library resource) has a base-config that permits it. The evidence in the report names the file.