InsecureHttpOption

Description

Options for allowing plain text HTTP connections for UnityWebRequest.

Plain text HTTP connections are not secure, and can make your application vulnerable to security threats. By default, UnityWebRequest uses secure HTTPS connections instead.

Use this enum to configure when UnityWebRequest is allowed to use HTTP plain text connections. To set the option for a project, do either of the following:

• Go to Edit > Project Settings > Player, open Other Settings, and set Allow downloads over HTTP in the Configuration group.
• Set PlayerSettings.insecureHttpOption in an Editor script, for example a build script.

Unity stores the option in the project's player settings and applies it to every platform in the project. PlayerSettings is part of the Editor API, so you can't change the option at runtime. Unity applies the value that the project has when you build the player.

The option affects only URLs that use the http scheme. Unity allows requests to localhost and 127.0.0.1 regardless of the option, so that you can use a local development server while you develop your application.

For more information, refer to Player settings and UnityWebRequest.

Additional resources: PlayerSettings.insecureHttpOption, UnityWebRequest.

using UnityEditor;
using UnityEngine;

// Place this script in a folder named Editor in your project.
// It adds a menu item that allows UnityWebRequest to use plain text HTTP
// connections in development builds, but not in release builds.

public class InsecureHttpOptionExample
{
    [MenuItem("Examples/Allow HTTP in development builds")]
    static void AllowHttpInDevelopmentBuilds()
    {
        // Read the option that the project currently uses.
        Debug.Log("Previous option: " + PlayerSettings.insecureHttpOption);

        // Set the option that Unity applies to the next player build.
        PlayerSettings.insecureHttpOption = InsecureHttpOption.DevelopmentOnly;
    }
}

Properties