<?xml version="1.0" encoding="utf-8"?>
<!--
  Permits cleartext HTTP to 127.0.0.1 ONLY. Required because just_audio +
  audio_service spin up a local HTTP proxy on loopback to inject the
  Authorization header (Android's MediaSession API can't pass headers down
  to ExoPlayer directly). Without this exemption, ExoPlayer hits Android's
  cleartext block when connecting to the local proxy and audio playback
  fails with "Cleartext HTTP traffic to 127.0.0.1 not permitted".

  All other hosts inherit cleartextTrafficPermitted="false" — actual
  remote traffic (to your Minstrel server) must still be HTTPS.

  Loopback traffic doesn't leave the device, so this exemption doesn't
  reduce security for real network endpoints.
-->
<network-security-config>
    <base-config cleartextTrafficPermitted="false" />
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="false">127.0.0.1</domain>
    </domain-config>
</network-security-config>
