Android-app: Local HTTP connection falls on Android 9

[GeorgeHahn]

Issue details

Duplicate?

Have you searched the issues of this repository if your issue is already known? yes

Actual behaviour

When trying to connect to a local server (192.168.x.x), the following message is shown and connection fails:
Connection test failed
Unknown error: CLEARTEXT communication to 192.168.x.x not permitted by network security policy

Expected behaviour

Connection succeeds. This worked up until the last app update.

Steps to reproduce the issue

1. Test connection using latest app on Android 9
2. Observe failure

Environment details

• wallabag app version: 2.1.0 (109)
• wallabag app installation source (e.g. Gplay, F-Droid, manual): gplay
• Android OS version: 9
• Android ROM (e.g. stock, LineageOS, SlimRom,…): stock essential ROM
• Android hardware: Essential PH1
• wallabag server version: can fill this in if required
• Do you have Two-Factor-Authentication enabled?: no

Logs

Omitted, but can submit if required.

Your experience with wallabag Android app

Have you had any luck using wallabag Android app before? (Sometimes we get tired of reading bug reports all day and a lil' positive end note does wonders)
Yes! The Wallabag Android app is fantastic! Happy user for about two years. Thank you!

[tcitworld]

https://stackoverflow.com/a/50834600/10204399

[MattMattV]

I experience the same issue.

Steps to reproduce the issue

1. Try to login to my self hosted instance of wallabag via https

Environment details

• wallabag app version: 2.1.0 (109)
• wallabag app installation source: F-Droid
• Android OS version: 9
• Android ROM: LineageOS 16
• Android hardware: OnePlus X
• wallabag server version: 2.3.2
• Do you have Two-Factor-Authentication enabled?: no

[andre-dierker]

Same issue here.
Android 9 does not allow to communicate in cleartext.

[tcitworld]

@GeorgeHahn @MattMattV @andre-dierker Out of curiosity, could you tell us the reason why you don't have https enabled on your servers (not possible technically, didn't felt the need, don't know how…) ?

[MattMattV]

Personally, https is enabled but port 80 is open to do a redirection to the port 443

[andre-dierker]

Of course https/tls is enabled, no redirect from 80 to 443. It is also not allowed to transfer passwords in plaintext via TLS.

[GeorgeHahn]

I don't run Wallabag on HTTPS because I host it on my local network.

[0xelion]

I have the same issue, but my wattabag is running with TLS (with redirect) trought a Traefik reverse proxy.
Any idea why i have this issue even though i'm in HTTPS?

[tcitworld]

@0xelion Do you set https://wallabag.tld as your instance URL inside the app, or http://wallabag.tld ? If https is set it should never try http.

[0xelion]

@tcitworld I run Wallabag on docker and my SYMFONY__ENV__DOMAIN_NAME variable is set as https://mysecurewallabag.mydomain.fr. I don't see any instance url option inside the app.

[tcitworld]

@0xelion I meant inside the Android app, something like > Settings > Connection > Your wallabag URL.

[0xelion]

@tcitworld It's also set as https://mysecurewallabag.mydomain.fr

[tcitworld]

@Strubbl Any idea why this happens ?

[Strubbl]

@0xelion there is @norweeg, who managed to make wallabag app work with traefik. Can you please have a look at his solution: https://github.com/wallabag/android-app/issues/756#issuecomment-462996975

[andre-dierker]

Maybe some informations can help.
My setup:
Dockered Wallabag behind Nginx http/2 enabled
on port 80 a 301 (redirect to port 443)

Android 9
Wallabag 2.1.0 (109)
wallabag-url: https://walla.6bq.de

Nginx log when I try to connect the app:
[25/Feb/2019:21:20:50 +0100] walla.6bq.de "GET / HTTP/2.0" 302
[25/Feb/2019:21:20:50 +0100] walla.6bq.de "GET / HTTP/2.0" 302

Wallabag log when I try to connect the app:
[25/Feb/2019:20:28:51 +0000] "GET / HTTP/1.1" 302 206 "-" "okhttp/3.12.1"
[25/Feb/2019:20:28:51 +0000] "GET / HTTP/1.1" 302 206 "-" "okhttp/3.12.1"

as u can see, two connections are done, propably due to redirection from 80 to 443. If I set url to http://... only one conection is done. It seems https:// is ignored.
I migrated my old Wallabag installation to my phone and this worked. After I reinstalled Wallabag this issue happens to me.

[andre-dierker]

According to https://github.com/wallabag/wallabag/issues/2273 it seems our problem is Laravel related.
Also there are a lot of hints to solve this, at least till its done via config options.
I fixed it (Docker, Nginx) with this comment:
https://github.com/wallabag/wallabag/issues/2273#issuecomment-452225672 which is doing in fact a rewrite(???) of the url

without proxy_redirect

andre@endymion ~ % curl -I https://walla.6bq.de
HTTP/2 302 
server: nginx
date: Tue, 26 Feb 2019 12:35:22 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.2.13
set-cookie: PHPSESSID=51b2c3c01c0b6e09f9ff024dce5c678b; path=/; HttpOnly
cache-control: no-cache, private
location: http://walla.6bq.de/login
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: no-referrer-when-downgrade

with proxy_redirect

andre@endymion ~ % curl -I https://walla.6bq.de
HTTP/2 302 
server: nginx
date: Tue, 26 Feb 2019 13:57:21 GMT
content-type: text/html; charset=UTF-8
location: https://walla.6bq.de/login
x-powered-by: PHP/7.2.14
set-cookie: PHPSESSID=dc6701d14d46a2e6e15db5b08be7ecd0; path=/; HttpOnly
cache-control: no-cache, private
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: no-referrer-when-downgrade

[GeorgeHahn]

Closing because the original error is solved with #762 merged.

@ maintainers - this issue holds some information on a related but different problem - feel free to reopen if appropriate.