v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.xml.android.nsc-cleartext-permitted

A network-security-config permits cleartext traffic (cleartextTrafficPermitted="true") in a <base-config> or in a <domain-config> that is not restricted to a loopback dev host.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

This lets HTTP run unencrypted for the covered domains, exposing OAuth tokens and API credentials to on-path capture (CWE-319). AI-generated configs enable this to unblock an http:// endpoint and leave it on for real hosts.

Set cleartextTrafficPermitted="false" (or rely on the API-28+ secure default). If cleartext is genuinely needed for local development, scope it to a <domain-config> that lists only loopback hosts (localhost / 10.0.2.2), which is not flagged.

VULNERABLE
vulnerable.xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!-- ruleid: auth.xml.android.nsc-cleartext-permitted -->
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
    <!-- ruleid: auth.xml.android.nsc-cleartext-permitted -->
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">api.example.com</domain>
    </domain-config>
</network-security-config>
SAFE
safe.xml
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!-- cleartext disabled globally: safe -->
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
    <!-- cleartext scoped to loopback dev hosts only: safe -->
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">localhost</domain>
        <domain includeSubdomains="true">10.0.2.2</domain>
    </domain-config>
</network-security-config>

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.xml.android.nsc-cleartext-permitted -- <reason>

References

https://developer.android.com/privacy-and-security/security-config#CleartextTrafficPermitted ↗https://cwe.mitre.org/data/definitions/319.html ↗