Android
Best practice
nsc-allows-plaintext-traffic
nsc-allows-plaintext-traffic
The Network Security Config is set to allow non-encrypted connections. Evaluate if this is necessary for your app, and disable it if appropriate. (To hide this warning, set
xmlns:tools="http://schemas.android.com/tools" tools:ignore="InsecureBaseConfiguration" as parameters to your <network-security-config>)nsc-pinning-without-backup
nsc-pinning-without-backup
Your app uses TLS public key pinning without specifying a backup key. If you are forced to change TLS keys or CAs on short notice, not having a backup pin can lead to connectivity issues until you can push out an update. It is considered best practice to add at least one additional pin as a backup.
nsc-pinning-without-expiration
nsc-pinning-without-expiration
Your app uses TLS public key pinning without specifying an expiration date. If your users do not update the app to receive new pins in time, expired or replaced certificates can lead to connectivity issues until they install an update. It is considered best practice to set an expiration time, after which the system will default to trusting system CAs and disregard the pin.
nsc-allows-user-ca-certs
nsc-allows-user-ca-certs
The Network Security Config is set to accept user-installed CAs. Evaluate if this is necessary for your app, and disable it if appropriate. (To hide this warning, set
xmlns:tools="http://schemas.android.com/tools" tools:ignore="AcceptsUserCertificates" as parameters to your <network-security-config>)nsc-allows-user-ca-certs-for-domain
nsc-allows-user-ca-certs-for-domain
The Network Security Config is set to accept user-installed CAs for the domain
$DOMAIN. Evaluate if this is necessary for your app, and disable it if appropriate. (To hide this warning, set xmlns:tools="http://schemas.android.com/tools" tools:ignore="AcceptsUserCertificates" as parameters to your <network-security-config>)manifest-usesCleartextTraffic-true
manifest-usesCleartextTraffic-true
The Android manifest is configured to allow non-encrypted connections. Evaluate if this is necessary for your app, and disable it if appropriate. This flag is ignored on Android 7 (API 24) and above if a Network Security Config is present.
manifest-usesCleartextTraffic-ignored-by-nsc
manifest-usesCleartextTraffic-ignored-by-nsc
Manifest uses both
android:usesCleartextTraffic and Network Security Config. The usesCleartextTraffic directive is ignored on Android 7 (API 24) and above if a Network Security Config is present.