title: Setting domain name of network_security_config.xml to localhost at runtime
body: <p>Since Android 9, Android by default only allows network connections over HTTPS. However the only requests i'm doing are done over the localhost (e.g <code>http://10.41.199.226:port/FooBar</code>) which is handled by a 
   (C#)<code>HttpListener</code> listening to that address:port combination.</p>
  
  <p>Since this request is made over HTTP Android doesn't by default allow it. Following <a href="https://developer.android.com/training/articles/security-config" rel="nofollow noreferrer">this documentation</a> by Android about the <code>network_security_config</code> file I can allow HTTP connections by adding the following <code>network_security_config.xml</code> file</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
   &lt;network-security-config&gt;
     &lt;base-config cleartextTrafficPermitted="true"&gt;
          &lt;trust-anchors&gt;
              &lt;certificates src="system" /&gt;
              &lt;certificates src="user" /&gt;
          &lt;/trust-anchors&gt;
      &lt;/base-config&gt;
      &lt;debug-overrides&gt;
          &lt;trust-anchors&gt;
              &lt;certificates src="user" /&gt;
          &lt;/trust-anchors&gt;
      &lt;/debug-overrides&gt;
  &lt;/network-security-config&gt;
  </code></pre>
  
  <p>Which is called from the Android manifest using <code>android:networkSecurityConfig="@xml/network_security_config"</code>.</p>
  
  <p>This allows the HTTP request to be completed, however because this sets the base-config it allows HTTP requests to be made across the entire app. This isn't a good idea seeing I may want to add outgoing requests in the future, which I would want to be over HTTPS and would like this safety net to be in place for that. Making this a no-go.</p>
  
  <p>Further on in that same document they introduce the <code>domain-config</code> which allows you to set the <code>cleartextTrafficPermitted</code> depending on the domain, which I tried with the following domains set</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
   &lt;network-security-config&gt;
      &lt;domain-config cleartextTrafficPermitted="true"&gt;
        &lt;domain includeSubdomains="true"&gt;127.0.0.1&lt;/domain&gt;
        &lt;domain includeSubdomains="true"&gt;10.0.0.1&lt;/domain&gt;
        &lt;domain includeSubdomains="true"&gt;localhost&lt;/domain&gt;
      &lt;/domain-config&gt;
  &lt;/network-security-config&gt;
  </code></pre>
  
  <p>With no results, requests were still getting blocked due to not being https.</p>
  
  <p>I looked up the device's local address, and added it to the domains list</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;domain-config cleartextTrafficPermitted="true"&gt;
      &lt;domain includeSubdomains="true"&gt;10.41.199.226&lt;/domain&gt; &lt;!--assume this is my local ip --&gt;
  &lt;/domain-config&gt;
  </code></pre>
  
  <p>This worked, and HTTP was allowed only when requested over the localhost, while any outgoing request would this require HTTPS.</p>
  
  <p>The only problem with this is is that I have no way of knowing the local ip off the device that'll run the app before the app is launched.</p>
  
  <p>So my question is, is there a way to either:<br></p>
  
  <ol>
  <li>Set the domain name to something that'll automatically register as the local ip? (something like <code>localhost</code> as I tried, but which didn't work)<br></li>
  <li>Add a "wildcard" IP address that'll accept any IP within the 10.x.x.x range (I had hoped setting <code>includeSubdomains="true"</code> would do this for me when adding a <code>10.0.0.0</code> address. But it doesn't)<br></li>
  <li>As a final resort, is it possible to edit the <code>network_security_config.xml</code> file at runtime, so I can dynamically update the domain name of one of the domain entries to the current local ip, when launching the app? </li>
  </ol>
  
  <p>The app is developed using Unity 2019.1.8 using the .net 4.x IL2CPP scripting runtime</p>