WebView showing ERRCLEARTEXTNOTPERMITTED although site is HTTPS duplicate

Encountering the “ERR_CLEARTEXT_NOT_PERMITTED” error in your Android WebView, despite your website using HTTPS, can be a frustrating experience for developers. This issue typically arises when your Android application is configured to block cleartext traffic (unencrypted HTTP), but the WebView is attempting to load resources over HTTP, or, more subtly, when there are mixed content issues. Mixed content refers to an HTTPS page loading resources, such as images, scripts, or stylesheets, over HTTP. Even if your main website URL uses HTTPS, these unencrypted resources can trigger the error. Let’s delve into the root causes of this problem and explore effective solutions to get your WebView working smoothly again. Dealing with this error requires a systematic approach, checking app configurations, server settings, and content sources to ensure complete adherence to secure communication protocols.

Understanding the ERR_CLEARTEXT_NOT_PERMITTED Error

The “ERR_CLEARTEXT_NOT_PERMITTED” error is a security measure implemented by Android to prevent applications from inadvertently transmitting sensitive data over unencrypted connections. Android’s Network Security Configuration (NSC) allows developers to define which domains can use cleartext traffic. By default, modern Android versions block cleartext traffic to enhance security. The purpose is to ensure that data transmitted between the app and the server is encrypted, protecting user information from eavesdropping and man-in-the-middle attacks. This error often surfaces when a WebView attempts to load content from a domain that the NSC prohibits from using cleartext. Even with HTTPS enforced on the main website, the error can still occur due to inconsistencies in how the WebView is configured or how the website is serving its resources. For example, an image embedded in the HTTPS site might be loaded via an HTTP URL, triggering the error.

This error is a direct response to the increasing need for secure data transmission in mobile applications. Google has been actively pushing for HTTPS adoption across the web, and this error is one way Android enforces this security measure. It’s important to remember that even if your website primarily uses HTTPS, any deviation from this standard can trigger the error in a WebView. “According to Google’s transparency report, over 95% of pages loaded in Chrome on Android are now HTTPS,” highlighting the widespread adoption and importance of secure connections [Source: Google Transparency Report]. Therefore, understanding and resolving this issue is crucial for maintaining a secure and functional mobile application.

Debugging this issue requires careful examination of your app’s Network Security Configuration and the resources being loaded by your WebView. This may involve inspecting network traffic, reviewing your app’s manifest file, and checking the server’s configuration. Addressing mixed content issues is often the key to resolving the “ERR_CLEARTEXT_NOT_PERMITTED” error. Remember that simply having HTTPS on your main domain is not enough; all resources loaded within the WebView must also be served over HTTPS.

Troubleshooting Steps for WebView ERR_CLEARTEXT_NOT_PERMITTED

When facing the “ERR_CLEARTEXT_NOT_PERMITTED” error, a systematic approach to troubleshooting is essential. Here’s a step-by-step guide to help you identify and resolve the issue:

Check your Network Security Configuration (NSC): Ensure that your network_security_config.xml file does not explicitly block cleartext traffic for the domain in question. If the NSC is overly restrictive, it might be preventing the WebView from loading even HTTPS content.
Inspect WebView Content: Use your browser’s developer tools (if possible) or a network sniffer like Charles Proxy to examine the resources being loaded by the WebView. Look for any HTTP URLs that are being requested, even if they are embedded within the HTTPS page.
Update Your App’s Manifest: Make sure your application’s manifest includes the necessary permissions for network access (android.permission.INTERNET). Also, check if you’ve explicitly declared android:usesCleartextTraffic=“false” in your application tag. If it’s set to true, change it to false.
Verify Server Configuration: Confirm that your server is properly configured to serve all resources over HTTPS. This includes checking SSL certificates, ensuring proper redirects from HTTP to HTTPS, and verifying that there are no mixed content issues.
Test on Different Android Versions: The behavior of WebView and Network Security Configuration can vary across different Android versions. Test your app on multiple Android versions to ensure compatibility.

Featured Snippet Optimization: The “ERR_CLEARTEXT_NOT_PERMITTED” error in WebView arises because Android blocks cleartext (HTTP) traffic by default. To fix it, carefully review your app’s network_security_config.xml file to ensure cleartext traffic isn’t unintentionally blocked for your domain. Also, inspect all resources loaded in your WebView, like images and scripts, to confirm they’re served over HTTPS. Correcting mixed content issues is crucial for resolving this error. This ensures all your website’s resources are securely loaded.

These troubleshooting steps cover the most common causes of the “ERR_CLEARTEXT_NOT_PERMITTED” error. By systematically checking each of these areas, you can pinpoint the source of the problem and implement the necessary fixes. Remember to thoroughly test your application after making any changes to ensure that the error is resolved and that your WebView is functioning correctly.

Common Causes and Solutions

Several factors can contribute to the “ERR_CLEARTEXT_NOT_PERMITTED” error. Identifying the specific cause is crucial for implementing the correct solution.

Incomplete HTTPS Implementation: Even if your website uses HTTPS, certain resources (images, scripts, stylesheets) might still be loaded over HTTP. This is known as mixed content and can trigger the error.
Incorrect Network Security Configuration: Your network_security_config.xml file might be misconfigured, either explicitly blocking cleartext traffic for your domain or not allowing it when it’s needed (in specific test scenarios).
Outdated WebView: An outdated WebView component on the user’s device might not fully support modern security protocols, leading to compatibility issues.

To address these common causes, consider the following solutions:

Enforce HTTPS Everywhere: Ensure that all resources on your website are served over HTTPS. Use tools like “Mixed Content Scan” to identify and fix any mixed content issues. Update your server configuration to automatically redirect HTTP requests to HTTPS.
Configure Network Security Properly: Review your network_security_config.xml file and adjust it to allow HTTPS traffic while blocking cleartext traffic for sensitive domains. Use the debuggable attribute to allow cleartext traffic in debug builds while enforcing HTTPS in production.
Update WebView Component: Encourage users to update their WebView component through the Google Play Store. You can also check the WebView version programmatically within your app and display a message prompting users to update if necessary.

For instance, imagine a scenario where a website has recently migrated to HTTPS but some older blog posts still contain images hosted on an HTTP server. This mixed content would trigger the “ERR_CLEARTEXT_NOT_PERMITTED” error in a WebView. The solution would involve either migrating those images to an HTTPS server or replacing them with HTTPS-compatible alternatives. Addressing these common causes proactively will help you avoid the “ERR_CLEARTEXT_NOT_PERMITTED” error and ensure a secure user experience. To learn more about secure coding practices, explore resources like the OWASP Foundation.

Advanced Configurations and Best Practices

Beyond the basic troubleshooting steps, some advanced configurations and best practices can help you prevent and manage the “ERR_CLEARTEXT_NOT_PERMITTED” error more effectively.

One crucial aspect is using a custom Network Security Configuration for different build types. For example, you might want to allow cleartext traffic in debug builds for testing purposes but enforce HTTPS strictly in release builds. You can achieve this by creating separate NSC files for each build type and specifying the appropriate file in your app’s manifest.

Another best practice is to implement proper error handling in your WebView. Instead of simply displaying a blank screen when an error occurs, provide informative messages to the user and log the error details for debugging. This can help you quickly identify and address issues related to the “ERR_CLEARTEXT_NOT_PERMITTED” error.

Furthermore, consider using Content Security Policy (CSP) headers on your server to control the resources that a WebView can load. CSP headers allow you to specify the sources from which the WebView can load scripts, stylesheets, images, and other resources. By using CSP headers, you can prevent the WebView from loading unauthorized resources and mitigate potential security risks [Source: Mozilla Developer Network]. Implementing these advanced configurations and best practices will not only help you prevent the “ERR_CLEARTEXT_NOT_PERMITTED” error but also improve the overall security and reliability of your WebView-based application. As stated by security expert Troy Hunt, “Security is not a product, but a process” [Source: Troy Hunt’s Blog], highlighting the ongoing nature of security efforts.

Infographic here showing the steps to debug ERR_CLEARTEXT_NOT_PERMITTED

FAQ ---

**Q: What does ERR\_CLEARTEXT\_NOT\_PERMITTED mean?**: A: It means your Android app is configured to block cleartext (HTTP) traffic, but the WebView is trying to load resources over HTTP.
**Q: How do I fix ERR\_CLEARTEXT\_NOT\_PERMITTED in WebView?**: A: Check your Network Security Configuration, ensure all resources are loaded over HTTPS, and verify your server settings.
**Q: Can HTTPS sites still trigger ERR\_CLEARTEXT\_NOT\_PERMITTED?**: A: Yes, if the HTTPS site loads resources (images, scripts) over HTTP (mixed content), it can trigger the error.

By systematically addressing potential causes, implementing robust security measures, and staying informed about best practices, you can navigate the complexities of WebView development and create secure, reliable applications. The [key takeaway](https://courthousezoological.com/n7sqp6kh?key=e6dd02bc5dbf461b97a9da08df84d31c) is to always prioritize security and ensure that all aspects of your app and website are configured to use HTTPS consistently.

Tackling the “ERR_CLEARTEXT_NOT_PERMITTED” error requires a comprehensive understanding of Android’s security mechanisms and a commitment to secure coding practices. From verifying your Network Security Configuration to diligently ensuring that all resources are served over HTTPS, each step plays a critical role in resolving this issue. By proactively addressing potential vulnerabilities and adopting a security-first mindset, you can ensure a smooth and secure user experience in your WebView-based applications. Ready to take your app’s security to the next level? Start by auditing your website for mixed content and reviewing your Network Security Configuration today. Explore our other articles on Android security best practices to further enhance your application’s resilience.

Question & Answer :

I'm starting to work on an app on Android, so I don't have much. All I have is just a WebView so far. I created the project in Android Studio, and my project got set as an Android InstantApp. I'm not sure why/how, but my guess is that I overlooked an option for it when creating the project.

I was getting an error from the WebView saying net::ERR_CLEARTEXT_NOT_PERMITTED. When I googled the error, I saw that when an app is an InstantApp, WebViews can only load sites that are HTTPS, and cannot load an HTTP site.

The purpose of this app is to be an extremely simple Flash player for only one site. This is to have better performance running a game that requires Flash. This game is at darkorbit.com, which is HTTPS.

MainActivity.java:

package com.tylerr147.darkorbit; import android.content.ComponentName; import android.content.Intent; import android.support.v7.app.AppCompatActivity; import android.os.Bundle; import android.view.View; import android.webkit.WebSettings; import android.webkit.WebView; public class MainActivity extends AppCompatActivity { @Override protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.activity_main); WebView wv = findViewById(R.id.webView1); wv.loadUrl("https://darkorbit.com/"); wv.setWebViewClient(new CustomWebViewClient()); WebSettings webSettings = wv.getSettings(); webSettings.setJavaScriptEnabled(true); webSettings.setPluginState(WebSettings.PluginState.ON); } }

and CustomWebViewClient.java

package com.tylerr147.darkorbit; import android.webkit.WebView; import android.webkit.WebViewClient; public class CustomWebViewClient extends WebViewClient { @Override public boolean shouldOverrideUrlLoading(WebView view, String url) { view.loadUrl(url); return true; } }

My question: How can I disable my app as an InstantApp, or how can I get this WebView to display the site?

I feel like it’s important I mention a few other details too: In the app, where it is showing the WebView, it also says “The webpage at http://darkorbit.com/” could not be loaded because: net::ERR_CLEARTEXT_NOT_PERMITTED

Notice that is says “… site at http://darkorbit.com/ …”, and not “… site at https://darkorbit.com/ …” even though the string for the URL is hardcoded, and says “https://darkorbit.com/”. Also, I am testing the app on an emulator set up as a Google Pixel 2 running Android 9.

Any help would be appreciated. Thank you.

Solution:

Add the below line in your application tag:

android:usesCleartextTraffic="true"

As shown below:

<application .... android:usesCleartextTraffic="true" ....>

UPDATE: If you have network security config such as: android:networkSecurityConfig="@xml/network_security_config"

No Need to set clear text traffic to true as shown above, instead use the below code:

<?xml version="1.0" encoding="utf-8"?> <network-security-config> <domain-config cleartextTrafficPermitted="true"> .... .... </domain-config> <base-config cleartextTrafficPermitted="false"/> </network-security-config>