OverviewFilesCommitsIssuesDocsReleasesPeers

favela-android commits / aa90cdb

allow cleartext to loopback so the UI can reach the favela-web running inside it
"Network request failed" on the timeline: since targetSdk 28 Android denies cleartext HTTP by default, so fetch('http://127.0.0.1:4041/api/timeline') was refused before it left the process. The server was up and answering the whole time — the worklet's own bare-fetch got 200, because it is not subject to Android's network security policy, which is exactly why the two disagreed. Scoped to 127.0.0.1 and localhost. usesCleartextTraffic="true" would permit plaintext to ANY host, which is a real weakening for an app that talks to PDSes and plc.directory over TLS; this permits only traffic that never leaves the device. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
aa90cdbf561c97d5733ef1a94fb4cabc8743cab2
by plankatron <fleeky@gmail.com> · 2026-08-11T01:22:59.000Z

Changed files (2) +19 -1

android/app/src/main/AndroidManifest.xml +2 -1
……@@ -13,7 +13,8 @@
1313 android:name=".MainApplication"
1414 android:label="@string/app_name"
1515 android:allowBackup="false"
16 android:theme="@style/Theme.AppCompat.DayNight.NoActionBar">
16 android:theme="@style/Theme.AppCompat.DayNight.NoActionBar"
17 android:networkSecurityConfig="@xml/network_security_config">
1718 <activity
1819 android:name=".MainActivity"
1920 android:exported="true"
android/app/src/main/res/xml/network_security_config.xml +17 -0
……@@ -0,0 +1,17 @@
1<?xml version="1.0" encoding="utf-8"?>
2<!--
3 favela-web runs INSIDE this app, on loopback (127.0.0.1:4041), and the UI fetches it. Since
4 targetSdk 28 Android denies cleartext HTTP by default, so those requests failed before leaving the
5 process — the UI showed "Network request failed" while the server was up and answering (the worklet's
6 own bare-fetch got 200, because it is not subject to Android's network security policy).
7
8 Scoped to loopback ON PURPOSE. `usesCleartextTraffic="true"` would permit plaintext to ANY host, which
9 is a real weakening for an app that talks to PDSes and the PLC directory over TLS. This permits only
10 traffic that never leaves the device.
11-->
12<network-security-config>
13 <domain-config cleartextTrafficPermitted="true">
14 <domain includeSubdomains="false">127.0.0.1</domain>
15 <domain includeSubdomains="false">localhost</domain>
16 </domain-config>
17</network-security-config>