Request was denied for security (net::ERR_INSECURE_RESPONSE)

Hi fellas.

I’m having a hard time to generate a functional .apk of my Ionic app. When Crosswalk is enabled I get this toast (“Request was denied for security”) and a error on all https calls (net::ERR_INSECURE_RESPONSE).

Could somebody give me a hand here? Thanks, guys!

config.xml

<?xml version='1.0' encoding='utf-8'?>
<widget id="xxx.yyy" version="0.0.1" xmlns="http://www.w3.org/ns/widgets" xmlns:cdv="http://cordova.apache.org/ns/1.0">
    <name>XXX.YYY</name>
    <description>xxx.yyy</description>
    <author email="xxx.yyy" href="xxx.yyy">xxx.yyy</author>
    <content src="index.html" />
    <access origin="*" />
    <allow-intent href="http://*/*" />
    <allow-intent href="https://*/*" />
    <allow-intent href="tel:*" />
    <allow-intent href="mailto:*" />
    <allow-navigation href="http://*/*" />
    <allow-navigation href="https://*/*" />
    <allow-navigation href="tel:*" />
    <allow-navigation href="mailto:*" />
    <platform name="android">
        <allow-intent href="market:*" />
		...
    </platform>
    <platform name="ios">
        <allow-intent href="itms:*" />
        <allow-intent href="itms-apps:*" />
		...
	</platform>
    <preference name="orientation" value="default" />
    <preference name="ScrollEnabled" value="false" />
    <preference name="StatusBarStyle" value="default" />
    <preference name="android-minSdkVersion" value="16" />
    <preference name="BackupWebStorage" value="none" />
    <preference name="SplashScreen" value="screen" />
    <preference name="SplashMaintainAspectRatio" value="true" />
    <preference name="FadeSplashScreenDuration" value="300" />
    <preference name="ShowSplashScreenSpinner" value="false" />
    <preference name="AutoHideSplashScreen" value="false" />
    <preference name="SplashScreenDelay" value="3000" />
    <preference name="SplashShowOnlyFirstTime" value="false" />
    <engine name="android" spec="^6.2.3" />
    <engine name="ios" spec="^4.5.3" />
    <plugin name="cordova-plugin-device" spec="^1.1.6" />
    <plugin name="cordova-plugin-inappbrowser" spec="^1.7.1" />
    <plugin name="cordova-plugin-splashscreen" spec="^4.0.3" />
    <plugin name="cordova-plugin-whitelist" spec="^1.3.2" />
    <plugin name="cordova-plugin-ionic-webview" spec="^1.1.15" />
    <plugin name="cordova-plugin-statusbar" spec="^2.2.3" />
    <plugin name="cordova-plugin-ionic-keyboard" spec="^2.0.2" />
    <plugin name="cordova-plugin-app-version" spec="^0.1.9" />
    <plugin name="mx.ferreyra.callnumber" spec="~0.0.2" />
    <plugin name="cordova-plugin-email-composer" spec="^0.8.11" />
    <plugin name="cordova-plugin-crosswalk-webview" spec="^2.3.0">
        <variable name="XWALK_VERSION" value="23+" />
        <variable name="XWALK_LITEVERSION" value="xwalk_core_library_canary:17+" />
        <variable name="XWALK_COMMANDLINE" value="--disable-pull-to-refresh-effect" />
        <variable name="XWALK_MODE" value="embedded" />
        <variable name="XWALK_MULTIPLEAPK" value="true" />
    </plugin>
</widget>

package.json

{
  "name": "xxx.yyy",
  "version": "0.0.1",
  "description": "xxx.yyy",
  "scripts": {
	...
  },
  "dependencies": {
    "@angular/common": "5.0.0",
    "@angular/compiler": "5.0.0",
    "@angular/compiler-cli": "5.0.0",
    "@angular/core": "5.0.0",
    "@angular/forms": "5.0.0",
    "@angular/http": "5.0.0",
    "@angular/platform-browser": "5.0.0",
    "@angular/platform-browser-dynamic": "5.0.0",
    "@ionic-native/app-version": "^4.4.2",
    "@ionic-native/call-number": "^4.4.2",
    "@ionic-native/core": "^4.3.1",
    "@ionic-native/email-composer": "^4.4.2",
    "@ionic-native/in-app-browser": "^4.3.1",
    "@ionic-native/splash-screen": "^4.3.1",
    "@ionic-native/status-bar": "^4.3.1",
    "@ionic/storage": "2.1.3",
    "call-number": "^1.0.1",
    "chart.js": "^2.7.1",
    "cordova-android": "^6.2.3",
    "cordova-ios": "^4.5.3",
    "cordova-plugin-app-version": "^0.1.9",
    "cordova-plugin-crosswalk-webview": "^2.3.0",
    "cordova-plugin-device": "^1.1.6",
    "cordova-plugin-email-composer": "^0.8.11",
    "cordova-plugin-inappbrowser": "^1.7.1",
    "cordova-plugin-ionic-keyboard": "^2.0.2",
    "cordova-plugin-ionic-webview": "^1.1.15",
    "cordova-plugin-splashscreen": "^4.0.3",
    "cordova-plugin-statusbar": "^2.2.3",
    "cordova-plugin-whitelist": "^1.3.2",
    "ionic-angular": "3.9.2",
    "ionicons": "3.0.0",
    "mx.ferreyra.callnumber": "~0.0.2",
    "ngx-pipes": "^2.0.5",
    "rxjs": "5.5.2",
    "sw-toolbox": "3.6.0",
    "zone.js": "0.8.18"
  },
  "devDependencies": {
    "@ionic/app-scripts": "3.1.5",
    "typescript": "~2.4.2"
  },
  "config": {
    "ionic_aot_write_to_disk": true,
    "ionic_source_map": "source-map",
    "ionic_webpack": "./webpack.config.js"
  },
  "cordova": {
    "platforms": [
      "android",
      "ios"
    ],
    "plugins": {
      "cordova-plugin-device": {},
      "cordova-plugin-inappbrowser": {},
      "cordova-plugin-splashscreen": {},
      "cordova-plugin-whitelist": {},
      "cordova-plugin-ionic-webview": {},
      "cordova-plugin-statusbar": {},
      "cordova-plugin-ionic-keyboard": {},
      "cordova-plugin-app-version": {},
      "mx.ferreyra.callnumber": {},
      "cordova-plugin-email-composer": {},
      "cordova-plugin-crosswalk-webview": {
        "XWALK_VERSION": "23+",
        "XWALK_LITEVERSION": "xwalk_core_library_canary:17+",
        "XWALK_COMMANDLINE": "--disable-pull-to-refresh-effect",
        "XWALK_MODE": "embedded",
        "XWALK_MULTIPLEAPK": "true"
      }
    }
  }
}

ionic.config.json

{
  "name": "xxx.yyy",
  "app_id": "",
  "type": "ionic-angular",
  "integrations": {
    "cordova": {}
  },
  "xwalk_hosts": [
    "http://*/",
    "https://*/"
  ]
}

I’m facing the same issue.

Did you get to solve it?

Thanks.

I faced the same problems and it’s related to Crosswalk(cordova-plugin-crosswalk-webview) I tried so many ways to solve that but I can’t, so I read about Crosswalk and one guy from Ionic team encouraged people to not use Crosswalk anymore, your issue will be fixed by just removing Crosswalk. It is not something you need anymore, you can use cordova-android@6.4.0 and it’s okay for a bunch of devices.

1 Like

Thanks for your help.

Since I’m working in an old app, I was looking for a solution without modifying the dependencies of the project. Knowing that crosswalk is no longer necessary, it seems that the best solution would be remove it.

I’ll try it tomorrow!

removing cordova-plugin-crosswalk-webview solves the problem, but I am still facing same issue on iOS

just remove S from your https only put only http

Without CrossWalk the app is working correctly, but we have managed to resolve the problem without removing it.

The error was related to our firewall. Someone made some changes in the firewall and it stopped accepting our https calls because of a old TLS encryption used by the app.

Sure, maybe it is related to the server and the certificate used in this server, here the problem was with the certificate and the apache redirects, now solved by fixing the certificate.