ionic-team / ionic-team/cordova-plugin-ionic-webview

Please discourage custom schemes

Open
#484 17 comments 5 reactions 0 assignees View on GitHub
Dominant language
Objective-C
Stars
493
Forks
410
PR merge metrics
No merged PRs in 30d

Description

I'm an engineer on the Android WebView team. Custom schemes are poorly defined in web platform standards, and Android WebView generally struggles to maintain backwards compatibility for these. #348 and https://issuetracker.google.com/issues/140057007 are just a couple examples of this fragile use case breaking.

I see https://github.com/ionic-team/cordova-plugin-ionic-webview#scheme documents support for changing the scheme of content. While we encourage changing the scheme to `https://` (and would even encourage making this the default, for improved web security), we strongly discourage any other scheme (`data:`, `file:///`, `blob:`, custom scheme, etc.). I would advise your docs to show the same recommendation.

If the app wants to distinguish injected content from real web content, they should host it on a unique domain rather than a unique scheme. This is the intended use case for https://developer.android.com/reference/androidx/webkit/WebViewAssetLoader.Builder.html#setDomain(java.lang.String).

CC @HazemSamir (the author of WebViewAssetLoader).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.