We Keep Coding

Android application unable to send http requests

I have an android application that uses Retrofit to make http requests (POST) and further evaluate incoming data.
I have the app working absolutely fine in my test phone (Samsung J5 P), it connects and sends requests as it should. But on trying operating the app simultaneously on two different phones, the app on the other phone somehow fails to send requests (retrofit calls onFailure method when a connection fails). I have enabled all permissions, yet the problem seems to happen.
Also, I have hosted the server on my desktop (localhost), and I made sure both my devices are connected to same network.
What could be causing this problem? Thanks.

Starting with Android 9 (API level 28), cleartext support is disabled by default.
Also have a look at - https://koz.io/android-m-and-the-war-on-cleartext-traffic/
Codelabs explanation - https://codelabs.developers.google.com/codelabs/android-network-security-config/index.html
Option 1 -
First try hitting the URL with "https://" instead of "http://"
Option 2 -
Create file res/xml/network_security_config.xml -
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">api.example.com(to be adjusted)</domain>
</domain-config>
</network-security-config>
AndroidManifest.xml -
<?xml version="1.0" encoding="utf-8"?>
<manifest ...>
<uses-permission android:name="android.permission.INTERNET" />
<application
...
android:networkSecurityConfig="#xml/network_security_config"
...>
...
</application>
</manifest>
Option 3 -
android:usesCleartextTraffic Doc
AndroidManifest.xml -
<?xml version="1.0" encoding="utf-8"?>
<manifest ...>
<uses-permission android:name="android.permission.INTERNET" />
<application
...
android:usesCleartextTraffic="true"
...>
...
</application>
</manifest>
android:targetSandboxVersion can be a problem too -
According to Manifest Docs -
android:targetSandboxVersion
The target sandbox for this app to use. The higher the sandbox version number, the higher the level of security. Its default value is 1; you can also set it to 2. Setting this attribute to 2 switches the app to a different SELinux sandbox. The following restrictions apply to a level 2 sandbox:
The default value of usesCleartextTraffic in the Network Security Config is false.
Uid sharing is not permitted.
So Option 4 -
If you have android:targetSandboxVersion in <manifest> then reduce it to 1
AndroidManifest.xml -
<?xml version="1.0" encoding="utf-8"?>
<manifest android:targetSandboxVersion="1">
<uses-permission android:name="android.permission.INTERNET" />
...
</manifest>

Create a network config file in res/xml directory
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">YOUR_IP</domain>
</domain-config>
</network-security-config>
and then add android:networkSecurityConfig="#xml/network_security_config" in your manifest's application tag

How to fix 'Cleartext HTTP traffic to x not permitted'

I'm trying to make a post request to an http server, but when I try to get an input stream I get the error java.io.IOException: Cleartext HTTP traffic to x not permitted
I've already tried putting android:usesCleartextTraffic="true" in my manifest, as well as making a network security config and setting the android:targetSandboxVersion to 1
app/src/main/res/xml/network_security_config.xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">Server adress</domain>
</domain-config>
</network-security-config>
app/src/main/AndroidManifest.xml
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.example.packagename"
android:targetSandboxVersion="1">
<uses-permission android:name="android.permission.INTERNET"/>
<application
android:allowBackup="true"
android:icon="#mipmap/ic_launcher"
android:label="#string/app_name"
android:roundIcon="#mipmap/ic_launcher_round"
android:supportsRtl="true"
android:theme="#style/AppTheme"
android:usesCleartextTraffic="true"
android:networkSecurityConfig="#xml/network_security_config"
>
<activity android:name=".MainActivity">
<intent-filter>
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.LAUNCHER" />
</intent-filter>
</activity>
</application>
Logcat output
D/NetworkSecurityConfig: Using Network Security Config from resource network_security_config debugBuild: true
W/System.err: java.io.IOException: Cleartext HTTP traffic to x not permitted
W/System.err: at com.android.okhttp.HttpHandler$CleartextURLFilter.checkURLPermitted(HttpHandler.java:124)
W/System.err: at com.android.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:462)
W/System.err: at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getResponse(HttpURLConnectionImpl.java:411)
W/System.err: at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getInputStream(HttpURLConnectionImpl.java:248)
Any help would be appreciated

Try using just
android:usesCleartextTraffic="true"
delete this 2
android:targetSandboxVersion="1"
android:networkSecurityConfig="#xml/network_security_config"
mine is working in any API just using android:usesCleartextTraffic="true"

If you are working in your local machine make sure that you are requesting to 10.0.2.2 instead of localhost (this is very important)
Then make sure that your AndroidManfest.xml file has following lines:
<uses-permission android:name="android.permission.INTERNET" />
<application
...
android:networkSecurityConfig="#xml/network_security_config">
and your network_security_config.xml file must look like this:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config cleartextTrafficPermitted="true">
<trust-anchors>
<certificates src="system" />
</trust-anchors>
</base-config>
</network-security-config>
or if you need to allow request to specific domains you could modify network_security_config.xml file with:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">10.0.2.2</domain>
</domain-config>
</network-security-config>
Both network_security_config.xml configurations works for me. I'm working on my local development enviroment.

Don't do like this way it may be get run time error
To Do easiest method;
go to android native project here you can see Properties click there then take AssemblyInfo.cs file then edit this part below
[assembly: Application(UsesCleartextTraffic = true)]
example below my code:-
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using Android.App;
// General Information about an assembly is controlled through the following
// set of attributes. Change these attribute values to modify the information
// associated with an assembly.
[assembly: AssemblyTitle("ZATWEBO.Android")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyProduct("ZATWEBO.Android")]
[assembly: AssemblyCopyright("Copyright © 2014")]
[assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")]
[assembly: ComVisible(false)]
// Version information for an assembly consists of the following four values:
//
// Major Version
// Minor Version
// Build Number
// Revision
//
// You can specify all the values or you can default the Build and Revision Numbers
// by using the '*' as shown below:
// [assembly: AssemblyVersion("1.0.*")]
[assembly: AssemblyVersion("1.0.0.0")]
[assembly: AssemblyFileVersion("1.0.0.0")]
// Add some common permissions, these can be removed if not needed
[assembly: UsesPermission(Android.Manifest.Permission.Internet)]
[assembly: UsesPermission(Android.Manifest.Permission.WriteExternalStorage)]
[assembly: Application(UsesCleartextTraffic = true)]
Note: this change only need android 9 Pie or higher versions

Create a file in your project
res/xml/security_config.xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">Your URL(ex: 127.0.0.1)</domain>
</domain-config>
</network-security-config>
AndroidManifest.xml
<?xml version="1.0" encoding="utf-8"?>
<manifest ...>
<uses-permission android:name="android.permission.INTERNET" />
<application
...
android:networkSecurityConfig="#xml/security_config"
...>
...
</application>
</manifest>
Also if you have android:targetSandboxVersion in then reduce it to 1

I added the following code to the Android Manifest file:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config>
<trust-anchors>
<certificates src="system">
</certificates>
</trust-anchors>
</base-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">http://YourURL/api/</domain>
</domain-config>
</network-security-config>

May be you made a mistake. Here is a correct format got it from another source.
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">Your URL(ex: 127.0.0.1)</domain>
</domain-config>
AndroidManifest.xml -
<?xml version="1.0" encoding="utf-8"?>
<manifest ...>
<uses-permission android:name="android.permission.INTERNET" />
<application
...
android:networkSecurityConfig="#xml/network_security_config"
...>
</application>
</manifest>
If you have android:targetSandboxVersion in then reduce it to 1
AndroidManifest.xml -
<?xml version="1.0" encoding="utf-8"?>
<manifest android:targetSandboxVersion="1">
<uses-permission android:name="android.permission.INTERNET" />
...

Solved my own problem, airing my shame for posterity.
Accidentally put a url in <domain includeSubdomains="true"></domain> instead of a domain.

I had the same problem and I solved it by lowering the android version to 25 in And, the application works well on devices with android 9 and smaller.
<uses-sdk
android:minSdkVersion="16"
android:targetSdkVersion="25" />

Make sure you have the https request for both post and origin header. If you have one http request and the other is htps:// it won't work I had the same problem with the same error.

NetworkSecurityConfig: No Network Security Config specified, using platform default Error response code: 400

I'm trying to connect to either of these places and get the JSON data:-
https://content.guardianapis.com/search?q=debate&tag=politics/politics&from-date=2014-01-01&api-key=test
https://content.guardianapis.com/search?q=debates&api-key=test
https://content.guardianapis.com/search?api-key=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx
All three I can get to via the browser, but when I try to access them via an android app I get the following errors:-
NetworkSecurityConfig: No Network Security Config specified, using platform default
Error response code: 400
I've added this to manifest.xml:-
<uses-permission android:name="android.permission.INTERNET"/>
I also added this to the manifest.xml:-
android:networkSecurityConfig="#xml/network_security_config"
And created res/xml/network_security_config.xml, which contains:-
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config>
<domain includeSubdomains="true">content.guardianapis.com</domain>>
</domain-config>
Which changes the error to:-
D/NetworkSecurityConfig: Using Network Security Config from resource network_security_config debugBuild: true
Error response code: 400
I know it's missing:-
<trust-anchors>
<certificates src="#raw/my_ca"/>
</trust-anchors>
but I have no idea where or what the certificate would be or if it's needed.
Not really sure what is going on, any help would be appreciated.
IN ADDITION:-
I am able to connect fine and get the JSON from this URL:-
https://earthquake.usgs.gov/fdsnws/event/1/query?format=geojson&eventtype=earthquake&orderby=time&minmag=6&limit=10
All I get is this:-
No Network Security Config specified, using platform default
Buy not error 400 and gets through with a 200 instead. So it makes me think there is something weird going on, but not sure where.

Try these solutions
Solution 1)
Add the following attribute to the <application tag in AndroidManifest.xml:
android:usesCleartextTraffic="true"
Solution 2)
Add android:networkSecurityConfig="#xml/network_security_config" to the <application tag in app/src/main/AndroidManifest.xml:
<application
android:name=".ApplicationClass"
android:allowBackup="true"
android:hardwareAccelerated="false"
android:icon="#mipmap/ic_launcher"
android:label="#string/app_name"
android:largeHeap="true"
android:networkSecurityConfig="#xml/network_security_config"
android:supportsRtl="true"
android:theme="#style/AppTheme">
With a corresponding network_security_config.xml in app/src/main/res/xml/:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config cleartextTrafficPermitted="true" />
</network-security-config>
Refer this answer for more info:
Download Manger not working in Android Pie 9.0 (Xiaomi mi A2)

Edited Answer
Remove <domain includeSubdomains="true">secure.example.com</domain> from the code.
Use just:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config cleartextTrafficPermitted="true" />
</network-security-config>
And It will work for any URL or IP.
Try to set cleartextTrafficPermitted=false
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">secure.example.com</domain>
</domain-config>
</network-security-config>

i was also facing the same problem ,and tried many solutions(adding config etc things),but they didn't work for me..I sit and checked my code carefully, There was something wrong in the code which i've wrote to access the node. Not a syntactic error, it's node name missmatch.

How to allow all Network connection types HTTP and HTTPS in Android (9) Pie?

From Android 9 Pie now, requests without encryption will never work. And by default, the System will expect you to use TLS by default.You can read this feature here So if you only make requests via HTTPS you are safe. But what about apps that make requests through different sites, for instance, browser-like apps.
How can I enable requests to all types of connections HTTP and HTTPS in Android 9 Pie?

The easy way to implement this is to use this attribute to your AndroidManifest.xml where you allow all http for all requests:
<application android:usesCleartextTraffic="true">
</application>
But in case you want some more configurations for different links for instance, allowing http for some domains but not other domains you must provide res/xml/networkSecurityConfig.xml file.
To do this in Android 9 Pie you will have to set a networkSecurityConfig in your Manifest application tag like this:
<?xml version="1.0" encoding="utf-8"?>
<manifest ... >
<application android:networkSecurityConfig="#xml/network_security_config">
</application>
</manifest>
Then in your xml folder you now have to create a file named network_security_config just like the way you have named it in the Manifest and from there the content of your file should be like this to enable all requests without encryptions:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config cleartextTrafficPermitted="true">
<trust-anchors>
<certificates src="system" />
</trust-anchors>
</base-config>
</network-security-config>
From there you are good to go. Now your app will make requests for all types of connections. For additional information on this topic read here.

The FULLY WORKING SOLUTION for both Android or React-native users facing this issue just add this
android:usesCleartextTraffic="true"
in AndroidManifest.xml file like this:
android:usesCleartextTraffic="true"
tools:ignore="GoogleAppIndexingWarning">
<uses-library
android:name="org.apache.http.legacy"
android:required="false" />
in between <application>.. </application> tag like this:
<application
android:name=".MainApplication"
android:label="#string/app_name"
android:icon="#mipmap/ic_launcher"
android:allowBackup="false"
android:theme="#style/AppTheme"
android:usesCleartextTraffic="true"
tools:ignore="GoogleAppIndexingWarning">
<uses-library
android:name="org.apache.http.legacy"
android:required="false" />
<activity
android:name=".MainActivity"
android:label="#string/app_name"/>
</application>

A simple way is set android:usesCleartextTraffic="true" on you AndroidManifest.xml
android:usesCleartextTraffic="true"
Your AndroidManifest.xml look like
<?xml version="1.0" encoding="utf-8"?>
<manifest package="com.dww.drmanar">
<application
android:icon="#mipmap/ic_launcher"
android:label="#string/app_name"
android:usesCleartextTraffic="true"
android:theme="#style/AppTheme"
tools:targetApi="m">
<activity
android:name=".activity.SplashActivity"
android:theme="#style/FullscreenTheme">
<intent-filter>
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.LAUNCHER" />
</intent-filter>
</activity>
</application>
</manifest>
I hope this will help you.

Easy Way
Add usesCleartextTraffic to AndroidManifest.xml
<application
...
android:usesCleartextTraffic="true"
...>
Indicates whether the app intends to use cleartext network traffic, such as cleartext HTTP. The default value for apps that target API level 27 or lower is "true". Apps that target API level 28 or higher default to "false".

For React Native applications while running in debug add the xml block mentioned by #Xenolion to react_native_config.xml located in <project>/android/app/src/debug/res/xml
Similar to the following snippet:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="false">localhost</domain>
<domain includeSubdomains="false">10.0.2.2</domain>
<domain includeSubdomains="false">10.0.3.2</domain>
</domain-config>
<base-config cleartextTrafficPermitted="true">
<trust-anchors>
<certificates src="system" />
</trust-anchors>
</base-config>
</network-security-config>

Just set usesCleartextTraffic flag in the application tag of AndroidManifest.xml file.
No need to create config file for Android.
<application
android:usesCleartextTraffic="true"
.
.
.>

i got the same problem and i notice that my security config has diferent TAGS like the #Xenolion answer says
<network-security-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">localhost</domain>
</domain-config>
</network-security-config>
so i change the TAGS "domain-config" for "base-config" and works, like this:
<network-security-config>
<base-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">localhost</domain>
</base-config>
</network-security-config>

This worked for me,
add this xml file to:
andriod/app/src/main/res/xml/network_security_config.xml
network_security_config.xml
xml/network_security_config.xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<base-config cleartextTrafficPermitted="true">
<trust-anchors>
<certificates src="system" />
</trust-anchors>
</base-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">your_domain1</domain>
</domain-config>
<domain-config cleartextTrafficPermitted="true">
<domain includeSubdomains="true">your_domain2</domain>
</domain-config>
</network-security-config>
then add this code to AndroidMenifest.xml
<application
...
android:usesCleartextTraffic="true"
android:networkSecurityConfig="#xml/network_security_config"
...
>
<!-- for http support-->
<uses-library android:name="org.apache.http.legacy" android:required="false"/>
...
</application>

You may check if you are sending clearText through HTTP
Fix : https://medium.com/#son.rommer/fix-cleartext-traffic-error-in-android-9-pie-2f4e9e2235e6
OR
In the Case of Apache HTTP client deprecation (From Google ) :
With Android 6.0, we removed support for the Apache HTTP client. Beginning with Android 9, that library is removed from the bootclasspath and is not available to apps by default.
To continue using the Apache HTTP client, apps that target Android 9 and above can add the following to their AndroidManifest.xml:
Source
https://developer.android.com/about/versions/pie/android-9.0-changes-28

AndroidManifest.xml not working properly

we are sooooo close to finishing our game, it is ready to be published through google play but we are having problems making any of the game services work.
we have a simple achievement button that should call the achievement UI, same goes for logging in. but we do not get any prompts when we are running it on our android device.
we have
PlayGamesPlatform.Activate();
in our start function
Social.localUser.Authenticate((bool success) => {
// handle success or failure
});
connected to a log in button
and
Social.ShowAchievementsUI();
on our show achievement button.
our email is connected as a tester on google play and the game service API's are all enabled
my real question is about the AndroidManifest that the game play service for unity created.
this is it:
<?xml version="1.0" encoding="utf-8"?>
<!-- This file was automatically generated by the Google Play Games plugin for Unity
Do not edit. -->
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.google.example.games.mainlibproj"
android:versionCode="1"
android:versionName="1.0" >
<uses-sdk android:minSdkVersion="8" android:targetSdkVersion="16" />
<application>
<!-- Required for Nearby Connections API -->
<meta-data android:name="com.google.android.gms.nearby.connection.SERVICE_ID"
android:value="" />
<!-- the space in these forces it to be interpreted as a string vs. int -->
<meta-data android:name="com.google.android.gms.games.APP_ID"
android:value="\ 606268116612" />
<meta-data android:name="com.google.android.gms.appstate.APP_ID"
android:value="\ 606268116612" />
<meta-data android:name="com.google.android.gms.version"
android:value="#integer/google_play_services_version" />
<activity android:name="com.google.games.bridge.NativeBridgeActivity"
android:theme="#android:style/Theme.Translucent.NoTitleBar.Fullscreen" />
</application>
</manifest>
i have read online that the package name should be our package name but shouldnt this be created when we run android set up using our ID number for our game? should i physically change this in code in the manifest even though it says i shouldnt edit it?
also OUR.ID i have replaced just for this question and in the real manifest has our actual ID No
Many Thanks In Advance

I always have the same package name (at application level) than my hierarchy in the project. In my opinion is a good practice to set the root at the folder where you have all your activities.
On the other hand, you can sign your app for market with the ID you want setting it in your gradle file.
You can see a good reference here.
I hope this would help you.