Network security configuration makes an application's connection-trust rules explicit. Establish whether every network client and SDK actually follows those rules.
Evaluation approach
Configuration can control cleartext traffic, trusted certificates and development exceptions. Verify which networking libraries use it; native code may take a different path.
Application example
Accept a development certificate only in test builds. Use network tests to verify that this trust does not reach the production package.
Limits and considerations
The presence of an XML file does not prove that every connection is secure.
Keep development conveniences out of production
A trust root, cleartext exception or broad domain scope added for testing creates different risks in production. Inspect the final package to establish which build variant receives the Network Security Configuration file.
Reviewing the source file alone may be insufficient because resource merging and product variants can change the result. Test normal connections, invalid certificates and incorrect hostnames against production endpoints separately. Also check how connection failures are presented to the user.
Checks and decisions
- Review cleartext coverage
- Separate debug exceptions
- Test the actual network stack
Restrict exceptions by domain and environment, and inspect the final package's traffic.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.