MobSF security report and android:usesCleartextTraffic=true

[scr2em]

I installed a new Ionic project with the latest cli and found that clearTextTraffic is enabled by default. but MobSF is considering a critical issue.

Why isn't it false by default ?
Is it safe to make it false ?

[jcesarmobile]

Ionic adds that to your project when you run the app using live reload, and removes it when you stop the live reload server.

Maybe it failed to remove the value when the server stopped, but it's not enabled by default, there should not be a usesCleartextTraffic entry at all.

[scr2em]

@jcesarmobile is it also the same for android:allowBackup="true" ?

[jcesarmobile]

No, that's the default value for all Capacitor apps.
It's also the default value when you create a native Android app from Android Studio.

Capacitor does not require to use that value, it just uses the default Android value, so you can change it if it's a security problem for your project.

[scr2em]

@jcesarmobile thank you