Delphi HTTP Clear Text Traffic on FMX Android

Environment:

• Delphi 11.1 ( used from Delphi XE 10)
• Android 12 32bit/64bit supported from Android 9 but work with Android 6.0 too

In many cases it may be necessary to access HTTP content on the network where SSL is not available for example:

• A server within your local network, on a VPN
• You have an httpServer directly in your application or on your device
• You need to access particular content on the internet that does not have a certificate available
• You need to access an IP address directly

To allow your Delphi app to call an HTTP service you need to create a standard android file called “network_security_config.xml” and add it to the list of files to distribute.

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
	<base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
    <domain-config cleartextTrafficPermitted="true">
       <domain includeSubdomains="true">localhost</domain>
       <domain includeSubdomains="true">127.0.0.1</domain>
    </domain-config>
</network-security-config>

In the domain-config section you can list all domains or IPs for which unencrypted traffic is allowed.

At this point it must be added to the project deployment:

It is also necessary to modify the “AndroidManifest.template.xml” file of your project by adding the line:

“android: networkSecurityConfig =” @ xml / network_security_config ”

in the “<application” section.

<?xml version="1.0" encoding="utf-8"?>
<!-- BEGIN_INCLUDE(manifest) -->
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
        package="%package%"
        android:versionCode="%versionCode%"
        android:versionName="%versionName%"
        android:installLocation="%installLocation%">
    <uses-sdk android:minSdkVersion="%minSdkVersion%" android:targetSdkVersion="%targetSdkVersion%" />
    <%uses-permission%>
    <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
    <uses-feature android:glEsVersion="0x00020000" android:required="True"/>
    <application android:persistent="%persistent%" 
    	android:networkSecurityConfig="@xml/network_security_config" 
        android:restoreAnyVersion="%restoreAnyVersion%" 
        android:label="%label%" 
        android:debuggable="%debuggable%" 
        android:largeHeap="%largeHeap%"
        android:icon="%icon%"
        android:theme="%theme%"
        android:hardwareAccelerated="%hardwareAccelerated%"
        android:usesCleartextTraffic="true"
        android:resizeableActivity="false"
        android:requestLegacyExternalStorage="true">
        <%provider%>
        <%application-meta-data%>
        <%uses-libraries%>
        <%services%>
        <!-- Our activity is a subclass of the built-in NativeActivity framework class.
             This will take care of integrating with our NDK code. -->
        <activity android:name="com.embarcadero.firemonkey.FMXNativeActivity"
                android:label="%activityLabel%"
                android:configChanges="orientation|keyboard|keyboardHidden|screenSize"
                android:launchMode="singleTask">
            <!-- Tell NativeActivity the name of our .so -->
            <meta-data android:name="android.app.lib_name"
                android:value="%libNameValue%" />
            <intent-filter>  
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter> 
        </activity>
        <%activity%>
        <%receivers%>
    </application>
</manifest>
<!-- END_INCLUDE(manifest) -->

Compile and test the project 🙂