In Android 9 Pie, handling network security efficiently is crucial for app development, particularly when it comes to managing network connections via HTTP and HTTPS. Utilizing the correct configuration ensures proper communication between an app and its web services, maintaining the security and integrity of user data. This article provides a technical walkthrough on permitting both HTTP and HTTPS connections, emphasizing methods, security configurations, and practical examples.

Network Security Configuration

To manage HTTP and HTTPS connections efficiently, Android 9 Pie introduces a feature called Network Security Configuration. This feature allows developers to customize their app's network security settings through a declarative configuration file, offering more granular control than was previously possible. It supports both secure (HTTPS) and insecure (HTTP) connections.

Creating a Network Security Configuration File

1. Define the Configuration File: The network security configuration is defined in an XML file. Typically, this file is named network_security_config.xml and is placed in the res/xml directory of your Android project.
   Example:

1   <?xml version="1.0" encoding="utf-8"?>
2   <network-security-config>
3       <domain-config cleartextTrafficPermitted="true">
4           <domain includeSubdomains="true">example.com</domain>
5           <trust-anchors>
6               <certificates src="system" />
7           </trust-anchors>
8       </domain-config>
9   </network-security-config>

• cleartextTrafficPermitted: This attribute allows HTTP connections if set to true.
• domain: Specify the domain for which this configuration applies.
• trust-anchors: Indicates the sources to be trusted, usually system-certificates.

1. Referencing the Configuration File: Once the XML is created, it must be referenced in the AndroidManifest.xml file.

1   <application
2       android:networkSecurityConfig="@xml/network_security_config"
3       android:usesCleartextTraffic="true">
4       ...
5   </application>

• android:networkSecurityConfig: Points to the custom security configuration file.
• android:usesCleartextTraffic: This attribute, if set to true, allows the app to make cleartext network traffic. Cleartext refers to network traffic that is not encrypted.

Handling Mixed Content

While enabling both HTTP and HTTPS provides flexibility, developers must handle mixed content issues carefully. HTTP and HTTPS can conflict when resources fetched over these protocols are mixed, especially if the main page URL uses HTTPS, but it loads HTTP resources.

Mitigating Security Risks

• Enable HTTPS Whenever Possible: Ensure APIs and resources are available over HTTPS and encourage fallback to safe modes.
• Use Modern Security Protocols: Ensure your HTTPS endpoints use updated protocols, preferably TLS 1.2 or TLS 1.3.
• CORS (Cross-Origin Resource Sharing): Manage cross-origin HTTP requests and use CORS headers to control access to resources.

Practical Example

1// Java code example to create an HTTP client instance.
2OkHttpClient client = new OkHttpClient.Builder()
3        .addInterceptor(new HttpLoggingInterceptor().setLevel(HttpLoggingInterceptor.Level.BODY))
4        .build();
5
6Request request = new Request.Builder()
7        .url("http://example.com/resource")
8        .build();
9
10Response response = client.newCall(request).execute();

This example uses OkHttp to make an HTTP request. Integrate error handling and logging to effectively manage network requests.

Key Points and Data Summary

Best Practices

1. Keep Libraries Updated: Use modern third-party libraries like OkHttp or Retrofit to handle network requests.
2. Disable Http by Default: Allow cleartext traffic only for specific needs as per domain configurations.
3. Regular Security Audits: Periodically review the application for security compliance and vulnerability exploits.
4. Use Post Production Debugging: Implement advanced debugging and analytics to monitor HTTP/HTTPS connection issues.

Utilizing Android's Network Security Configuration appropriately can significantly influence the security posture of an application. Proper understanding and execution of these configurations enable developers to safely support various network connection types across different domains, offering users a consistent and secure experience.