Skip to content

Release build talks to the server over cleartext HTTP (passwords in the clear) #16

Description

@CanReader

The client talks to the backend over plain HTTP, including the release build. In Settings.java:

public static final String DEBUG_SERVER_URL   = "http://10.37.50.186:8282";
public static final String RELEASE_SERVER_URL = "http://www.focuskingdom.polandcentral.cloudapp.azure.com:8282";

and the manifest opts into cleartext:

android:usesCleartextTraffic="true"

Everything, REST login/register, the socket connection, asset downloads, telemetry, goes over unencrypted HTTP on port 8282 with no TLS. That means the user's password (the client posts the plaintext password on login and register), the JWT, and all game traffic travel in the clear. Anyone on the same network (public WiFi, a malicious hotspot, the ISP) can read the credentials and hijack the session.

This is the kind of thing that also gets a release flagged in Play Console pre-launch reports. The server should be behind HTTPS (TLS terminated at a reverse proxy or the Azure endpoint), the client URLs switched to https, and usesCleartextTraffic removed (or restricted to just the debug/local IP if you need cleartext for local dev).

Files: core/src/com/focus/kingdom/Settings.java (server URLs, line 15-16), android/AndroidManifest.xml (usesCleartextTraffic, line 20).

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions