From e9531298e7e05ace95ee3e06bce8fac037f1fdc3 Mon Sep 17 00:00:00 2001
From: Graham Smith <graham@wiseman-designs.com>
Date: Wed, 2 Sep 2020 17:26:00 +0100
Subject: [PATCH] [IMPROVEMENT] Disable HTTP for production on Android (#2357)

* Only enable HTTP and user CAs on debug builds and

* Allow User CAs in prod

* Add config on debug

* Add lint

Co-authored-by: Diego Mello <diegolmello@gmail.com>
---
 android/app/src/debug/AndroidManifest.xml              |  3 ++-
 .../app/src/debug/res/xml/network_security_config.xml  | 10 ++++++++++
 .../app/src/main/res/xml/network_security_config.xml   |  7 ++++---
 3 files changed, 16 insertions(+), 4 deletions(-)
 create mode 100644 android/app/src/debug/res/xml/network_security_config.xml

diff --git a/android/app/src/debug/AndroidManifest.xml b/android/app/src/debug/AndroidManifest.xml
index ed773abe1..bc6c63eab 100644
--- a/android/app/src/debug/AndroidManifest.xml
+++ b/android/app/src/debug/AndroidManifest.xml
@@ -7,7 +7,8 @@
         android:name=".MainDebugApplication"
         tools:ignore="GoogleAppIndexingWarning"
         tools:replace="android:name"
-        tools:targetApi="28" />
+        tools:targetApi="28"
+        android:networkSecurityConfig="@xml/network_security_config" />
 
     <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
 </manifest>
\ No newline at end of file
diff --git a/android/app/src/debug/res/xml/network_security_config.xml b/android/app/src/debug/res/xml/network_security_config.xml
new file mode 100644
index 000000000..45f56937c
--- /dev/null
+++ b/android/app/src/debug/res/xml/network_security_config.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config xmlns:tools="http://schemas.android.com/tools">
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="user"
+                tools:ignore="AcceptsUserCertificates" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>
\ No newline at end of file
diff --git a/android/app/src/main/res/xml/network_security_config.xml b/android/app/src/main/res/xml/network_security_config.xml
index bb6ab93df..ef899d459 100644
--- a/android/app/src/main/res/xml/network_security_config.xml
+++ b/android/app/src/main/res/xml/network_security_config.xml
@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
-<network-security-config>
-    <base-config cleartextTrafficPermitted="true">
+<network-security-config xmlns:tools="http://schemas.android.com/tools">
+    <base-config cleartextTrafficPermitted="false">
         <trust-anchors>
             <certificates src="system" />
-            <certificates src="user" />
+            <certificates src="user"
+                tools:ignore="AcceptsUserCertificates" />
         </trust-anchors>
     </base-config>
 </network-security-config>
\ No newline at end of file