Why is cleartextTrafficPermitted tag not detected when enclosed in debug-overrides tag of my Xamarin Android network_security_config.xml file?

Question

I have a Xamarin.Forms application, for which I am able to debug in cleartext (http) mode, based on the inclusion of a network_security_config.xml file as follows:

<network-security-config>
   <base-config cleartextTrafficPermitted="true" />
</network-security-config>

However, if I move the cleartextTrafficPermitted setting inside of a debug-overrides tag as follows, I get the error "Cleartext HTTP traffic to MYSITE is not permitted."

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <debug-overrides>
      <base-config cleartextTrafficPermitted="true" />
  </debug-overrides>
</network-security-config>

My application is running in debug mode. Even though app debugging was already working and mode was Debug, just in case I tried adding debuggable:true explicitly to the application tag in my AndroidManifest.xml, and have also tried adding (Debuggable = true) as a parameter in the ApplicationAttribute over my main application class declaration, but regardless of how I set the app to be debuggable, the base-config tag seems to be ignored if it's nested inside of a debug-overrides tag. Am I doing something wrong? Is there some other way to allow for HTTP to be permitted in debug mode but not in release mode?

Answer 1

I would suggest you to use domain specific config.

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!-- default config that does not allow plain text traffic -->
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>

    <!-- Specific config for local tests (enable plain text traffic) -->
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">localhost</domain>
    </domain-config>

</network-security-config>

The debug-overrides tag, as described in the android documentation, does not take the cleartextTrafficPermitted option.

Answer 2

android:usesCleartextTraffic="true"

put this line in application tag in manifest file.

Answer 3

Changing the [Application] attribute over my Application class as follows allows me to use HTTP during debug compiles only:

#if(DEBUG)
    [Application(UsesCleartextTraffic=true)]
#else
    [Application]
#endif