Disable HSTS. https://redmine.stoutner.com/issues/480

[PrivacyBrowserAndroid.git] / app / src / main / res / xml / network_security_config.xml

diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
index e7ed677fd2823c699e6e99b406fdacb880c51a3e..16a90b5cca58ba736d2cb2042bd3804a4420eef1 100644 (file)
--- a/app/src/main/res/xml/network_security_config.xml
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -18,7 +18,7 @@
   You should have received a copy of the GNU General Public License
   along with Privacy Browser.  If not, see <http://www.gnu.org/licenses/>. -->
 
   You should have received a copy of the GNU General Public License
   along with Privacy Browser.  If not, see <http://www.gnu.org/licenses/>. -->
 

-<!-- Allow HTTP traffic. -->
+<!-- Allow HTTP traffic and disable HSTS, which has no benefit for Privacy Browser (because unspecified links default to HTTPS) but has negative fingerprinting implications. -->

 <network-security-config>
 <network-security-config>

-    <base-config cleartextTrafficPermitted="true" />
+    <base-config cleartextTrafficPermitted="true" hstsEnforced="false" />

 </network-security-config>
\ No newline at end of file
 </network-security-config>
\ No newline at end of file