diff options
| author | Chad Brubaker <cbrubaker@google.com> | 2017-10-19 13:23:47 -0700 |
|---|---|---|
| committer | Chad Brubaker <cbrubaker@google.com> | 2017-10-23 13:18:59 -0700 |
| commit | fcc46336014d59cb9f28ae0543ad855a9e01bdf4 (patch) | |
| tree | c8823bd4253c8eb3c6ed7e3b284d3bf7154a7e6b /core/java/android | |
| parent | 5ac2ea1b4d6dbaca045acd4ae9f82bb27089d5f2 (diff) | |
Change cleartext traffic permitted default for P apps
For applications targeting P and above the network security
config's cleartextTrafficPermitted will default to false instead of
the previous true.
Bug: 63931636
Test: network security config cts tests
Change-Id: Ia697358ad84e2092443c3eff518003c6a11e4630
Diffstat (limited to 'core/java/android')
| -rw-r--r-- | core/java/android/security/net/config/NetworkSecurityConfig.java | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/core/java/android/security/net/config/NetworkSecurityConfig.java b/core/java/android/security/net/config/NetworkSecurityConfig.java index b9e550540217..52f48ef8499b 100644 --- a/core/java/android/security/net/config/NetworkSecurityConfig.java +++ b/core/java/android/security/net/config/NetworkSecurityConfig.java @@ -164,7 +164,8 @@ public final class NetworkSecurityConfig { * <p> * The default configuration has the following properties: * <ol> - * <li>Cleartext traffic is permitted for non-ephemeral apps.</li> + * <li>If the application targets API level 27 (Android O MR1) or lower then cleartext traffic + * is allowed by default.</li> * <li>Cleartext traffic is not permitted for ephemeral apps.</li> * <li>HSTS is not enforced.</li> * <li>No certificate pinning is used.</li> @@ -183,7 +184,8 @@ public final class NetworkSecurityConfig { // System certificate store, does not bypass static pins. .addCertificatesEntryRef( new CertificatesEntryRef(SystemCertificateSource.getInstance(), false)); - final boolean cleartextTrafficPermitted = info.targetSandboxVersion < 2; + final boolean cleartextTrafficPermitted = info.targetSdkVersion < Build.VERSION_CODES.P + && info.targetSandboxVersion < 2; builder.setCleartextTrafficPermitted(cleartextTrafficPermitted); // Applications targeting N and above must opt in into trusting the user added certificate // store. |