Wsrtjtyk

In the AndroidManifest I found this parameter:

    android:networkSecurityConfig="@xml/network_security_config"

and @xml/network_security_config is defined in network_security_config.xml as:

<?xml version="1.0" encoding="utf-8"?>

<network-security-config>

    <!--Set application-wide security config using base-config tag.-->

    <base-config cleartextTrafficPermitted="false"/>

</network-security-config>  

just I changed cleartextTrafficPermitted to true

You might only want to allow cleartext while debugging, but keep the security benefits of rejecting cleartext in production. This is useful for me because I test my app against a development server that does not support https. Here is how to enforce https in production, but allow cleartext in debug mode:

In build.gradle:

// Put this in your buildtypes debug section:

manifestPlaceholders = [usesCleartextTraffic:"true"]



// Put this in your buildtypes release section

manifestPlaceholders = [usesCleartextTraffic:"false"]

In the application tag in AndroidManifest.xml

android:usesCleartextTraffic="${usesCleartextTraffic}"

Change your url's from HTTP to HTTPS;

It works out!!!

It could be useful for someone.

We recently had the same issue for Android 9, but we only needed to display some Urls within WebView, nothing very special. So adding android:usesCleartextTraffic="true" to Manifest worked, but we didn't want to compromise security of the whole app for this.
So the fix was in changing links from http to https

<?xml version="1.0" encoding="utf-8"?>

<network-security-config>

    <domain-config cleartextTrafficPermitted="true">

        <domain includeSubdomains="true">***Your URL(ex: 127.0.0.1)***</domain>

    </domain-config>

</network-security-config>

In the suggestion provided above I was providing my URL as http://xyz.abc.com/mno/

I changed that to xyz.abc.com then it started working.

My problem in Android 9 was navigating on a webview over domains with http
The solution from this answer

<application 

    android:networkSecurityConfig="@xml/network_security_config"

    ...>

and:

res/xml/network_security_config.xml

<?xml version="1.0" encoding="utf-8"?>

<network-security-config>

    <base-config cleartextTrafficPermitted="true">

        <trust-anchors>

            <certificates src="system" />

        </trust-anchors>

    </base-config>

</network-security-config>

Ok, that is ⇒⇒ NOT ⇐⇐ the thousands repeat of add it to your Manifest, but an hint which base on this, but give you additional Benefit (and maybe some Background Info).

Android has a kind of overwriting functionality for the src-Directory.

By default, you have

/app/src/main

But you can add additional directories to overwrite your AndroidManifest.xml. Here is how it works:

• Create the Directory /app/src/debug
  


• Inside create the AndroidManifest.xml

Inside of this File, you don't have to put all the Rules inside, but only the ones you like to overwrite from your /app/src/main/AndroidManifest.xml

Here an Example how it looks like for the requested CLEARTEXT-Permission:

<manifest xmlns:android="http://schemas.android.com/apk/res/android"

          package="com.yourappname">



    <application

            android:usesCleartextTraffic="true"

            android:name=".MainApplication"

            android:label="@string/app_name"

            android:icon="@mipmap/ic_launcher"

            android:allowBackup="false"

            android:theme="@style/AppTheme">

    </application>



</manifest>

With this knowledge it's now easy as 1,2,3 for you to overload your Permissions depending on your debug | main | release Enviroment.

The big benefit on it... you don't have debug-stuff in your production-Manifest and you keep an straight and easy maintainable structure

Okay, I have figured this out. It is due to the Manifest parameter android:targetSandboxVersion="2", that I have added because we also have Instant App version - it should make sure than once user upgrades from Instant App to regular app, he will not loose his data with the transfer. However as the vague description suggest:

Specifies the target sandbox this app wants to use. Higher sanbox versions will have increasing levels of security.

The default value of this attribute is 1.

It obviously also adds new level of security policy, at least on Android 8.

For React Native projects

It was already fixed on RN 0.59.
You can find on upgrade diff from 0.58.6 to 0.59
You can apply it without upgrading you RN versionust follow the below steps:

Create files:

android/app/src/debug/res/xml/react_native_config.xml -

<?xml version="1.0" encoding="utf-8"?>

<network-security-config>

  <domain-config cleartextTrafficPermitted="true">

    <domain includeSubdomains="false">localhost</domain>

    <domain includeSubdomains="false">10.0.2.2</domain>

    <domain includeSubdomains="false">10.0.3.2</domain>

  </domain-config>

</network-security-config>

android/app/src/debug/AndroidManifest.xml -

<?xml version="1.0" encoding="utf-8"?>

<manifest xmlns:android="http://schemas.android.com/apk/res/android"

  xmlns:tools="http://schemas.android.com/tools">



  <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>



  <application tools:targetApi="28"

      tools:ignore="GoogleAppIndexingWarning" 

      android:networkSecurityConfig="@xml/react_native_config" />

</manifest>

Check the accepted answer to know the root cause.

Upgrade to React Native 0.58.5 or higher version.
They have includeSubdomain in their config files in RN 0.58.5.

ChangeLog

In Rn 0.58.5 they have declared network_security_config with their server domain. Network security configuration allows an app to permit cleartext traffic from a certain domain. So no need to put extra effort by declaring android:usesCleartextTraffic="true" in the application tag of your manifest file. It will be resolved automatically after upgrading the RN Version.