Android network configuration permits cleartext (HTTP) traffic

Android Network Security Configuration permits cleartext HTTP traffic (cleartextTrafficPermitted="true" in network_security_config.xml, or android:usesCleartextTraffic="true" in AndroidManifest.xml). Combined with Flutter’s ignore-OS-proxy behaviour this exposes the app to trivial MitM on any hostile network.

Android since API 28 enforces cleartext-traffic blocking by default: http:// connections from any Android system component (WebView, HttpsURLConnection, OkHttp) are refused unless the app explicitly opts in. The two opt-in flags are:

Either flag re-opens the cleartext path. For Flutter apps the exposure is wider than for native Android apps: Flutter’s dart:io HttpClient runs OUTSIDE the Android networking stack and isn’t affected by this XML at all — but enabling it signals that the developer accepts cleartext traffic, and any native plugin / WebView using the Android stack inherits the permission.

Either way: any Wi-Fi / LAN / ISP attacker decrypts and forges HTTP responses, and the app may load attacker-supplied content (including malicious WebView content as in unrestricted_webview_load).

Set both flags to false (or omit them — the secure default). For genuinely-cleartext local-development scenarios, scope the exception to a <domain-config> for localhost / 10.0.2.2 only, and never ship that profile to a release build.

This detector does not need any configuration.