How to Resolve the 'NetworkSecurityConfig: No Network Security Config Specified' Error in Android?

What does the error 'NetworkSecurityConfig: No Network Security Config specified, using platform default' mean in Android applications?

// Example AndroidManifest.xml configuration
<application
    android:networkSecurityConfig="@xml/network_security_config"
    ...
/>

The error message 'NetworkSecurityConfig: No Network Security Config specified, using platform default' indicates that your Android application is not using a specified network security configuration. Instead, it falls back to the default security settings provided by the platform. This can be problematic, especially when dealing with sensitive data or when specific security rules must be enforced.

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">example.com</domain>
    </domain-config>
</network-security-config>

Causes

• The application does not contain a network security configuration XML file.
• The application’s AndroidManifest.xml lacks the reference to the network security configuration file.
• Improperly defined security settings that fail to meet the application's network requirements.

Solutions

• Create a network security configuration XML file (e.g., 'network_security_config.xml') that specifies the security rules for your app.
• Reference the network security configuration in the AndroidManifest.xml file under the application tag.
• Ensure that the security configuration adheres to the requirements of your APIs and network endpoints.

Mistake: Not including the network_security_config.xml file when deploying the application.

Solution: Always include the network security configuration file in your project resources.

Mistake: Forgetting to add the xmlns declaration in the XML file.

Solution: Ensure your XML file starts with the proper declaration: '<?xml version="1.0" encoding="utf-8"?>'.

Mistake: Setting cleartextTrafficPermitted improperly, leading to unexpected behavior.

Solution: Set cleartextTrafficPermitted to 'true' only when necessary, and prefer HTTPS to secure communication.