cordova-android/framework/res/xml/phonegap.xml

<?xml version="1.0" encoding="utf-8"?>
<phonegap>
	<!--  
	access elements control the Android whitelist.  
	Domains are assumed blocked unless set otherwise
	 -->

    <access origin="http://127.0.0.1*"/> <!-- allow local pages -->

	<!-- <access origin="https://example.com" /> allow any secure requests to example.com -->
	<!-- <access origin="https://example.com" subdomains="true" /> such as above, but including subdomains, such as www -->
	<!-- <access origin=".*"/> Allow all domains, suggested development use only -->

    <log level="DEBUG"/>
    <render legacy="true" />
</phonegap>