Bypass certificate pinning for development builds with network-security-config.xml?

Question

We want to bypass SSL for certain flavours of app which is used internally. What is the best way to do it?

Can we configure the network-security-config.xml so it ignores pinning for a particular build flavour?

Or we have to override the TrustManager class?

Answer 1

I have been using gradle source sets for this kind of purpose.

debug source set has a network security config that does not have pinning enabled.

release source set has a different network security config file that has everything needed for a production configuration.

In a gradle module, these source sets sit on the top src level, with main being the default.