Agent Wranglers

MOB-45Required

Allow no cleartext traffic from the app

Release builds send every request over TLS and trust only the system certificate authorities. They carry no global App Transport Security exception and no Android cleartext permission.

By Agent Wranglers. Updated .

How to do it

Both platforms block plain HTTP by default. App Transport Security has applied since the iOS 9 SDK, and Android 9 turned cleartext off. The defaults break when a build adds NSAllowsArbitraryLoads, sets cleartextTrafficPermitted="true" or trusts user-installed certificates in release. Apple notes that ATS does not cover lower-level network interfaces, so check sockets and third-party networking libraries too. Keep exceptions to named debug hosts in debug-overrides, which Android ignores in release builds. Servers follow serve everything over HTTPS. Add certificate pinning only with a tested plan for rotating keys, because a stale pin cuts every user off.

Examples

XML example

<network-security-config>
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors><certificates src="system" /></trust-anchors>
    </base-config>
    <debug-overrides>
        <trust-anchors><certificates src="user" /></trust-anchors>
    </debug-overrides>
</network-security-config>

How to check

A script reads the release Info.plist and the merged Android manifest and fails on NSAllowsArbitraryLoads, usesCleartextTraffic="true", cleartextTrafficPermitted="true" or src="user" outside debug-overrides. A proxy test of the release build sees no plain HTTP request.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/no-cleartext-traffic">Agent Wranglers mobile apps playbook</a>. In code you write, add a comment next to it with the same link.