Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) Summary: [Nested Classes](https://developer.android.com/reference/android/security/NetworkSecurityPolicy#nestedclasses) \| [Constants](https://developer.android.com/reference/android/security/NetworkSecurityPolicy#constants) \| [Methods](https://developer.android.com/reference/android/security/NetworkSecurityPolicy#pubmethods) \| [Inherited Methods](https://developer.android.com/reference/android/security/NetworkSecurityPolicy#inhmethods)

# NetworkSecurityPolicy

*** ** * ** ***


`
public


class
NetworkSecurityPolicy
`


`

extends https://developer.android.com/reference/java/lang/Object


`

`


`

|---|---|
| [java.lang.Object](https://developer.android.com/reference/java/lang/Object) ||
| ↳ | android.security.NetworkSecurityPolicy |

<br />

*** ** * ** ***

Network security policy.

Network stacks/components should honor this policy to make it possible to centrally control
the relevant aspects of network security behavior.

## Summary

| ### Nested classes ||
|---|---|
| ` class` | `https://developer.android.com/reference/android/security/NetworkSecurityPolicy.Builder` A builder for a `https://developer.android.com/reference/android/security/NetworkSecurityPolicy`. |

| ### Constants ||
|---|---|
| `int` | `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#DOMAIN_ENCRYPTION_MODE_DISABLED` Domain encryption is disabled for the app. |
| `int` | `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#DOMAIN_ENCRYPTION_MODE_ENABLED` Domain encryption is in fully enabled mode for the app. |
| `int` | `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#DOMAIN_ENCRYPTION_MODE_OPPORTUNISTIC` *This constant was deprecated in API level 37.2. Use `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#DOMAIN_ENCRYPTION_MODE_ENABLED` instead.* |
| `int` | `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#DOMAIN_ENCRYPTION_MODE_REQUIRED` Domain encryption is required for the app and should fail closed (i.e. |
| `int` | `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#DOMAIN_ENCRYPTION_MODE_UNKNOWN` Unknown setting for domain encryption in the app. |

| ### Public methods ||
|---|---|
| ` int` | ` https://developer.android.com/reference/android/security/NetworkSecurityPolicy#getDomainEncryptionMode(java.lang.String)(https://developer.android.com/reference/java/lang/String hostname) ` Returns the domain encryption mode the app has chosen for the given `hostname`, including the setting for Encrypted Client Hello. |
| ` static https://developer.android.com/reference/android/security/NetworkSecurityPolicy` | ` https://developer.android.com/reference/android/security/NetworkSecurityPolicy#getInstance()() ` Gets the policy for this process. |
| ` boolean` | ` https://developer.android.com/reference/android/security/NetworkSecurityPolicy#isCertificateTransparencyVerificationRequired(java.lang.String)(https://developer.android.com/reference/java/lang/String hostname) ` Returns `true` if Certificate Transparency information is required to be verified by the client in TLS connections to `hostname`. |
| ` boolean` | ` https://developer.android.com/reference/android/security/NetworkSecurityPolicy#isCleartextTrafficPermitted(java.lang.String)(https://developer.android.com/reference/java/lang/String hostname) ` Returns whether cleartext network traffic (e.g. HTTP, FTP, XMPP, IMAP, SMTP -- without TLS or STARTTLS) is permitted for communicating with `hostname` for this process. |
| ` boolean` | ` https://developer.android.com/reference/android/security/NetworkSecurityPolicy#isCleartextTrafficPermitted()() ` Returns whether cleartext network traffic (e.g. HTTP, FTP, WebSockets, XMPP, IMAP, SMTP -- without TLS or STARTTLS) is permitted for all network communication from this process. |

### Inherited methods

From class `

https://developer.android.com/reference/java/lang/Object

` `


https://developer.android.com/reference/java/lang/Object` `
https://developer.android.com/reference/java/lang/Object#clone()()
`

Creates and returns a copy of this object.


`


boolean` `
https://developer.android.com/reference/java/lang/Object#equals(java.lang.Object)(https://developer.android.com/reference/java/lang/Object obj)
`

Indicates whether some other object is "equal to" this one.


`


void` `
https://developer.android.com/reference/java/lang/Object#finalize()()
`

Called by the garbage collector on an object when garbage collection
determines that there are no more references to the object.


`


final

https://developer.android.com/reference/java/lang/Class<?>` `
https://developer.android.com/reference/java/lang/Object#getClass()()
`

Returns the runtime class of this `Object`.


`


int` `
https://developer.android.com/reference/java/lang/Object#hashCode()()
`

Returns a hash code value for the object.


`


final

void` `
https://developer.android.com/reference/java/lang/Object#notify()()
`

Wakes up a single thread that is waiting on this object's
monitor.


`


final

void` `
https://developer.android.com/reference/java/lang/Object#notifyAll()()
`

Wakes up all threads that are waiting on this object's monitor.


`


https://developer.android.com/reference/java/lang/String` `
https://developer.android.com/reference/java/lang/Object#toString()()
`

Returns a string representation of the object.


`


final

void` `
https://developer.android.com/reference/java/lang/Object#wait(long,%20int)(long timeoutMillis, int nanos)
`

Causes the current thread to wait until it is awakened, typically
by being *notified* or *interrupted*, or until a
certain amount of real time has elapsed.


`


final

void` `
https://developer.android.com/reference/java/lang/Object#wait(long)(long timeoutMillis)
`

Causes the current thread to wait until it is awakened, typically
by being *notified* or *interrupted*, or until a
certain amount of real time has elapsed.


`


final

void` `
https://developer.android.com/reference/java/lang/Object#wait()()
`

Causes the current thread to wait until it is awakened, typically
by being *notified* or *interrupted*.


## Constants

### DOMAIN_ENCRYPTION_MODE_DISABLED

Added in [API level 37](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)  
Also in [C Extensions 22](https://developer.android.com/sdkExtensions)

```
public static final int DOMAIN_ENCRYPTION_MODE_DISABLED
```

Domain encryption is disabled for the app. ECH and GREASE should not be used.

<br />

Constant Value:

1
(0x00000001)


### DOMAIN_ENCRYPTION_MODE_ENABLED

Added in [API level 37](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)  
Also in [C Extensions 22](https://developer.android.com/sdkExtensions)

```
public static final int DOMAIN_ENCRYPTION_MODE_ENABLED
```

Domain encryption is in fully enabled mode for the app. ECH will be enabled when there is
server support, otherwise GREASE will be used.

<br />

Constant Value:

3
(0x00000003)


### DOMAIN_ENCRYPTION_MODE_OPPORTUNISTIC

Added in [API level 37](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)  
Also in [C Extensions 22](https://developer.android.com/sdkExtensions)   
Deprecated in [API level
37.2](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public static final int DOMAIN_ENCRYPTION_MODE_OPPORTUNISTIC
```


**This constant was deprecated
in API level 37.2.**   

Use `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#DOMAIN_ENCRYPTION_MODE_ENABLED` instead.

<br />

<br />

Constant Value:

2
(0x00000002)


### DOMAIN_ENCRYPTION_MODE_REQUIRED

Added in [version 37.2](https://developer.android.com/topic/libraries/support-library/revisions)  
Also in [C Extensions 24](https://developer.android.com/sdkExtensions)

```
public static final int DOMAIN_ENCRYPTION_MODE_REQUIRED
```

Domain encryption is required for the app and should fail closed (i.e. if ECH cannot be
enabled for any reason, the connection will fail).

If a valid ECH configuration is not available (e.g. because the DNS server does not return
ECHConfigList in a SVCB/HTTPS record), connections will fail.

<br />

Constant Value:

4
(0x00000004)


### DOMAIN_ENCRYPTION_MODE_UNKNOWN

Added in [API level 37](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)  
Also in [C Extensions 22](https://developer.android.com/sdkExtensions)

```
public static final int DOMAIN_ENCRYPTION_MODE_UNKNOWN
```

Unknown setting for domain encryption in the app.

This is the default value returned by `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#getDomainEncryptionMode(java.lang.String)` when not
overridden. Network libraries should avoid performing any domain encryption and perform a
standard TLS handshake, equivalent to `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#DOMAIN_ENCRYPTION_MODE_DISABLED`.

<br />

Constant Value:

0
(0x00000000)


## Public methods

### getDomainEncryptionMode

Added in [API level 37](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)  
Also in [C Extensions 22](https://developer.android.com/sdkExtensions)

```
public int getDomainEncryptionMode (String hostname)
```

Returns the domain encryption mode the app has chosen for the given `hostname`,
including the setting for Encrypted Client Hello.

<br />

| Parameters ||
|---|---|
| `hostname` | `String`: hostname to check what domain encryption mode has been chosen by the app. This value cannot be `null`. <br /> |

| Returns ||
|---|---|
| `int` | int representing the domain encryption mode. Value is one of the following: - `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#DOMAIN_ENCRYPTION_MODE_UNKNOWN` - `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#DOMAIN_ENCRYPTION_MODE_DISABLED` - `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#DOMAIN_ENCRYPTION_MODE_OPPORTUNISTIC` - `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#DOMAIN_ENCRYPTION_MODE_ENABLED` - `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#DOMAIN_ENCRYPTION_MODE_REQUIRED` |

### getInstance

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public static NetworkSecurityPolicy getInstance ()
```

Gets the policy for this process.

It's fine to cache this reference. Any changes to the policy will be immediately visible
through the reference.

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/android/security/NetworkSecurityPolicy` | This value cannot be `null`. <br /> |

### isCertificateTransparencyVerificationRequired

Added in [API level 36](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isCertificateTransparencyVerificationRequired (String hostname)
```

Returns `true` if Certificate Transparency information is required to be verified by
the client in TLS connections to `hostname`.

See RFC6962 section 3.3 for more details.

<br />

| Parameters ||
|---|---|
| `hostname` | `String`: hostname to check whether certificate transparency verification is required. This value cannot be `null`. <br /> |

| Returns ||
|---|---|
| `boolean` | `true` if certificate transparency verification is required and `false` otherwise <br /> |

### isCleartextTrafficPermitted

Added in [API level 24](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isCleartextTrafficPermitted (String hostname)
```

Returns whether cleartext network traffic (e.g. HTTP, FTP, XMPP, IMAP, SMTP -- without
TLS or STARTTLS) is permitted for communicating with `hostname` for this process.

<br />

| Parameters ||
|---|---|
| `hostname` | `String`: This value may be `null`. <br /> |

| Returns ||
|---|---|
| `boolean` | <br /> |

**See also:**

- `https://developer.android.com/reference/android/security/NetworkSecurityPolicy#isCleartextTrafficPermitted()`

### isCleartextTrafficPermitted

Added in [API level 23](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public boolean isCleartextTrafficPermitted ()
```

Returns whether cleartext network traffic (e.g. HTTP, FTP, WebSockets, XMPP, IMAP, SMTP --
without TLS or STARTTLS) is permitted for all network communication from this process.

When cleartext network traffic is not permitted, the platform's components (e.g. HTTP and
FTP stacks, `https://developer.android.com/reference/android/app/DownloadManager`, `https://developer.android.com/reference/android/media/MediaPlayer`) will
refuse this process's requests to use cleartext traffic. Third-party libraries are strongly
encouraged to honor this setting as well.

This flag is honored on a best effort basis because it's impossible to prevent all
cleartext traffic from Android applications given the level of access provided to them. For
example, there's no expectation that the `https://developer.android.com/reference/java/net/Socket` API will honor this flag
because it cannot determine whether its traffic is in cleartext. However, most network
traffic from applications is handled by higher-level network stacks/components which can
honor this aspect of the policy.

NOTE: `https://developer.android.com/reference/android/webkit/WebView` honors this flag for applications targeting API level
26 and up.

<br />

| Returns ||
|---|---|
| `boolean` | <br /> |