Should I add android:networkSecurityConfig="@xml/network_security_config"?

Question

I need your take on this. The target SDKs of my android app are android:minSdkVersion="28" and android:targetSdkVersion="35". Is it okay if I won't create Network Security Configuration since I am targeting SDKs >28 and <35?

Are there security concerns for this if I ignore creating the network_security_config.xml?

I did not include network_security_config.xml in my Android Application.

Brijesh Joshi · Accepted Answer · 2025-08-23 11:24:30Z

0

No, you don't need to add it. Omitting the file is the most secure option.

Since your app targets API 28+, Android automatically blocks all insecure cleartext (http://) traffic by default. This is a crucial security feature.

You only need to create a network_security_config.xml file if you need to create an exception to this secure default, such as:

Allowing http:// traffic to a specific legacy domain (discouraged).
Trusting custom certificates for debugging.
Implementing certificate pinning.

For standard apps that only communicate over https://, doing nothing is the best practice.

answered Aug 23 at 11:24

Brijesh Joshi

1,8671 gold badge11 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Anon User Aug 23 at 11:48

Got it. Thank you for explaining it.

Collectives™ on Stack Overflow

Should I add android:networkSecurityConfig="@xml/network_security_config"?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related