github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-03-12 05:04:17 -05:00
Code Issues 144 Packages Projects Releases 116 Wiki Activity

[PR #5533] [MERGED] [PM-23314] Enforce HTTPS #5847

New Issue
Closed
opened 2025-11-27 00:15:26 -06:00 by GiteaMirror · 0 comments
GiteaMirror commented 2025-11-27 00:15:26 -06:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/bitwarden/android/pull/5533
Author: @andrebispo5
Created: 7/16/2025
Status: ✅ Merged
Merged: 7/17/2025
Merged by: @andrebispo5

Base: main ← Head: pm-23314/enforce-https

📝 Commits (4)

  • 60a6135 [PM-23314] Remove the ability to use http for service calls
  • cb3c85b [PM-23314] Add debug configuration to allow http.
  • 7d23968 [PM-23314] Remove debug file and use debug-overrides
  • d03a8a5 Revert "[PM-23314] Remove debug file and use debug-overrides"

📊 Changes

2 files changed (+28 additions, -3 deletions)

View changed files

➕ app/src/debug/res/xml/network_security_config.xml (+27 -0)
📝 app/src/main/res/xml/network_security_config.xml (+1 -3)

📄 Description

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-23314

📔 Objective

🔐 Disabled the Ability to Use HTTP in Release Builds

As part of Bitwarden’s ongoing commitment to security and consistency across platforms, this change disables the ability to use HTTP (non-secure) communication in the Android client’s release builds. All network traffic must now be transmitted over HTTPS, aligning with best practices and existing behavior in other Bitwarden clients.

🛡️ Why This Change

  • Security: Preventing cleartext (HTTP) communication protects sensitive data from being intercepted or modified in transit.

  • Consistency: Bitwarden’s clients already default to HTTPS. This brings the Android app in line with those standards.

  • Minimized Attack Surface: Disabling HTTP support helps mitigate the risk of downgrade attacks and misconfigured endpoints.

These principles are also described in Bitwarden’s Security Whitepaper – Data in Transit, which outlines the use of TLS and HSTS to enforce secure communication.

⚙️ Implementation Details

  • Release builds of the app no longer permit HTTP connections.

  • Debug builds retain HTTP support to allow flexibility for local development, testing, and self-hosted environments.

This change ensures that users benefit from secure-by-default behavior in production while developers still have the tools they need to test across environments.

💡 For Self-Hosted Users

We understand that this update may impact some workflows, particularly in development or internal environments. If you're running a self-hosted Bitwarden instance, ensure that your environment is configured with valid SSL/TLS certificates. Bitwarden provides setup guidance here: 📄 Bitwarden Help – Certificates

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/bitwarden/android/pull/5533 **Author:** [@andrebispo5](https://github.com/andrebispo5) **Created:** 7/16/2025 **Status:** ✅ Merged **Merged:** 7/17/2025 **Merged by:** [@andrebispo5](https://github.com/andrebispo5) **Base:** `main` ← **Head:** `pm-23314/enforce-https` --- ### 📝 Commits (4) - [`60a6135`](https://github.com/bitwarden/android/commit/60a6135eef82829094192af67b66d251ccbf1fbb) [PM-23314] Remove the ability to use http for service calls - [`cb3c85b`](https://github.com/bitwarden/android/commit/cb3c85b4f8093a55c7e4fe89248b8d3bef21e098) [PM-23314] Add debug configuration to allow http. - [`7d23968`](https://github.com/bitwarden/android/commit/7d23968e54651426e91a87f3eba2cd743666f765) [PM-23314] Remove debug file and use debug-overrides - [`d03a8a5`](https://github.com/bitwarden/android/commit/d03a8a5464fead2a7678a08c30f61d9bca29fbbd) Revert "[PM-23314] Remove debug file and use debug-overrides" ### 📊 Changes **2 files changed** (+28 additions, -3 deletions) <details> <summary>View changed files</summary> ➕ `app/src/debug/res/xml/network_security_config.xml` (+27 -0) 📝 `app/src/main/res/xml/network_security_config.xml` (+1 -3) </details> ### 📄 Description ## 🎟️ Tracking <!-- Paste the link to the Jira or GitHub issue or otherwise describe / point to where this change is coming from. --> https://bitwarden.atlassian.net/browse/PM-23314 ## 📔 Objective ### 🔐 **Disabled the Ability to Use HTTP in Release Builds** As part of Bitwarden’s ongoing commitment to security and consistency across platforms, this change disables the ability to use HTTP (non-secure) communication in the Android client’s release builds. All network traffic must now be transmitted over HTTPS, aligning with best practices and existing behavior in other Bitwarden clients. ### 🛡️ **Why This Change** - **Security:** Preventing cleartext (HTTP) communication protects sensitive data from being intercepted or modified in transit. - **Consistency:** Bitwarden’s clients already default to HTTPS. This brings the Android app in line with those standards. - **Minimized Attack Surface:** Disabling HTTP support helps mitigate the risk of downgrade attacks and misconfigured endpoints. These principles are also described in [Bitwarden’s Security Whitepaper – Data in Transit](https://bitwarden.com/help/bitwarden-security-white-paper/), which outlines the use of TLS and HSTS to enforce secure communication. ### ⚙️ **Implementation Details** - **Release builds** of the app no longer permit HTTP connections. - **Debug builds** retain HTTP support to allow flexibility for local development, testing, and self-hosted environments. This change ensures that users benefit from secure-by-default behavior in production while developers still have the tools they need to test across environments. ### 💡 **For Self-Hosted Users** We understand that this update may impact some workflows, particularly in development or internal environments. If you're running a self-hosted Bitwarden instance, ensure that your environment is configured with valid SSL/TLS certificates. Bitwarden provides setup guidance here: 📄 [Bitwarden Help – Certificates](https://bitwarden.com/help/certificates/) ## ⏰ Reminders before review - Contributor guidelines followed - All formatters and local linters executed and passed - Written new unit and / or integration tests where applicable - Protected functional changes with optionality (feature flags) - Used internationalization (i18n) for all UI strings - CI builds passed - Communicated to DevOps any deployment requirements - Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team ## 🦮 Reviewer guidelines <!-- Suggested interactions but feel free to use (or not) as you desire! --> - 👍 (`:+1:`) or similar for great changes - 📝 (`:memo:`) or ℹ️ (`:information_source:`) for notes or general info - ❓ (`:question:`) for questions - 🤔 (`:thinking:`) or 💭 (`:thought_balloon:`) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion - 🎨 (`:art:`) for suggestions / improvements - ❌ (`:x:`) or ⚠️ (`:warning:`) for more significant problems or concerns needing attention - 🌱 (`:seedling:`) or ♻️ (`:recycle:`) for future improvements or indications of technical debt - ⛏ (`:pick:`) for minor or nitpick changes --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2025-11-27 00:15:26 -06:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#5847
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?