From 9b014d5df628eaf2fa18e1bf38ac10e861f3ceb1 Mon Sep 17 00:00:00 2001
From: Andy Scherzinger <info@andy-scherzinger.de>
Date: Tue, 17 Mar 2026 14:52:25 +0100
Subject: [PATCH] docs: Add reasoning for the allowance of http as well as user
 certs

Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
---
 app/src/main/res/xml/network_security_config.xml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
index 2a8427fe64ec..88fa40038b92 100644
--- a/app/src/main/res/xml/network_security_config.xml
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -2,18 +2,21 @@
 <!--
   ~ Nextcloud - Android Client
   ~
-  ~ SPDX-FileCopyrightText: 2017-2024 Nextcloud GmbH and Nextcloud contributors
-  ~ SPDX-FileCopyrightText: 2017 Andy Scherzinger <info@andy-scherzinger.de>
+  ~ SPDX-FileCopyrightText: 2017-2026 Nextcloud GmbH and Nextcloud contributors
   ~ SPDX-License-Identifier: AGPL-3.0-or-later OR GPL-2.0-only
 -->
 <network-security-config xmlns:tools="http://schemas.android.com/tools">
-    <base-config cleartextTrafficPermitted="true"
+    <!-- Allowing cleartextTrafficPermitted - we don't control the server yet strongly suggesting TLS/SSL -->
+    <base-config
+        cleartextTrafficPermitted="true"
         tools:ignore="InsecureBaseConfiguration">
         <trust-anchors>
             <!-- Trust preinstalled CAs -->
-            <certificates src="system"/>
+            <certificates src="system" />
             <!-- Additionally trust user added CAs -->
-            <certificates src="user"
+            <!-- We allow user-certificates so managed device can make use of self-signed/client certificates -->
+            <certificates
+                src="user"
                 tools:ignore="AcceptsUserCertificates" />
         </trust-anchors>
     </base-config>