The client talks to the backend over plain HTTP, including the release build. In Settings.java:
public static final String DEBUG_SERVER_URL = "http://10.37.50.186:8282";
public static final String RELEASE_SERVER_URL = "http://www.focuskingdom.polandcentral.cloudapp.azure.com:8282";
and the manifest opts into cleartext:
android:usesCleartextTraffic="true"
Everything, REST login/register, the socket connection, asset downloads, telemetry, goes over unencrypted HTTP on port 8282 with no TLS. That means the user's password (the client posts the plaintext password on login and register), the JWT, and all game traffic travel in the clear. Anyone on the same network (public WiFi, a malicious hotspot, the ISP) can read the credentials and hijack the session.
This is the kind of thing that also gets a release flagged in Play Console pre-launch reports. The server should be behind HTTPS (TLS terminated at a reverse proxy or the Azure endpoint), the client URLs switched to https, and usesCleartextTraffic removed (or restricted to just the debug/local IP if you need cleartext for local dev).
Files: core/src/com/focus/kingdom/Settings.java (server URLs, line 15-16), android/AndroidManifest.xml (usesCleartextTraffic, line 20).
The client talks to the backend over plain HTTP, including the release build. In Settings.java:
and the manifest opts into cleartext:
Everything, REST login/register, the socket connection, asset downloads, telemetry, goes over unencrypted HTTP on port 8282 with no TLS. That means the user's password (the client posts the plaintext password on login and register), the JWT, and all game traffic travel in the clear. Anyone on the same network (public WiFi, a malicious hotspot, the ISP) can read the credentials and hijack the session.
This is the kind of thing that also gets a release flagged in Play Console pre-launch reports. The server should be behind HTTPS (TLS terminated at a reverse proxy or the Azure endpoint), the client URLs switched to https, and usesCleartextTraffic removed (or restricted to just the debug/local IP if you need cleartext for local dev).
Files:
core/src/com/focus/kingdom/Settings.java(server URLs, line 15-16),android/AndroidManifest.xml(usesCleartextTraffic, line 20).