Best practice check list to make Android WebView Secure

Question

I am working on an application which is largely written in Native and supporting Ice Cream Sandwich. However, I need to add some WebViews. There are lots of discussions on WebView security and when I use setJavaScriptEnabled(true), it gives me a warning:"Using setJavaScriptEnabled can introduce XSS vulnerabilities into you application, review carefully."

Just want to be very careful using WebView and setJavaScriptEnable(true). I have followed Android WebView Security Tips and suggestions. But there is no best practice check list.

What I have done so far:

Only load trusted content to WebView. Either from local html or from our back end.

Intercept all requests from WebView by implementing

webView.setWebViewClient(new WebViewClient() {
    @Override
    public boolean shouldOverrideUrlLoading(WebView view, String url) {
        // magic
        return true;
    }
});

Make sure all back end requests are using https and only sent to our back end.
Detect SSL warning.
Checksum check local html/JavaScript files.
Minify JavaScript files
Update Security Provider to Protect Against SSL Exploits

There are also some other protections not specifically for WebView, such as encrypt messages and jail broken check, etc.

Is there anything else I am missing? How secure is my app?

Thanks

We need to make sure it's secure before publish to google play store. — Steven, Sep 28 '16 at 03:03
It sounds like you've done everything you can reasonably do. The key steps are #1 and #3. — Antimony, Oct 04 '16 at 18:46
Thanks for your comment. Would you like to give an answer and I can vote? — Steven, Oct 05 '16 at 03:50

Android Developer · Accepted Answer · 2017-06-27T12:36:33.940

10

As per doc,

To enable Safe Browsing for all WebViews in your app, add in a manifest tag:
<manifest>
     <meta-data android:name="android.webkit.WebView.EnableSafeBrowsing"
                android:value="true" />
      . . .
     <application> . . . </application> </manifest> 
Because WebView is distributed as a separate APK, Safe Browsing for WebView is available today for devices running Android 5.0 and above. With just one added line in your manifest, you can update your app and improve security for most of your users immediately.

edited Jun 27 '17 at 12:36

answered Jun 27 '17 at 12:02

Android Developer

9,157
18
82
139

2

Isn't EnableSafeBrowsing set to true by default? "While the default value of EnableSafeBrowsing is true, there are occasional cases when you may want to only enable Safe Browsing conditionally or disable it. Android 8.0 (API level 26) and higher support using setSafeBrowsingEnabled()" – TSlegaitis Mar 12 '19 at 13:54
2

It is inside [application tag](https://developer.android.com/guide/webapps/managing-webview), isn't it? – Amg91 Mar 17 '20 at 16:34
yes as the previous comment, meta-data tag is not allowed outside of application tag in manifest – ziniestro Jun 02 '23 at 05:12

Best practice check list to make Android WebView Secure

1 Answers1

Linked