[Feature]: Disable outgoing traffic from WebView2

[thongw]

Describe the feature/enhancement you need

We are integrating WebView2 within our application to facilitate dialog hosting. However, we have a strict requirement to eliminate any outgoing traffic to external endpoints. During our testing phase, we observed that msedgewebview2.exe is generating outgoing traffic. We need to address this issue to ensure compliance with our network policies.

The scenario/use case where you would use this feature

We have received a customer request to ensure our application operates without making any requests to external endpoints due to security and privacy concerns.

How important is this request to you?

Impactful. My app's user experience would be significantly compromised without it.

Suggested implementation

Have a flag to disable sending of outgoing traffic from WebView2

What does your app do? Is there a pending deadline for this request?

No response

[Lakshmisha-KS]

Thanks @thongw for raising this request.

While WebView2 does not currently offer a native flag to globally disable network traffic, the following application-level strategies can be combined to effectively suppress outbound communication:

• Block requests manually: You can use the WebResourceRequested event to catch and block specific outgoing requests. [Here’s the official doc - https://learn.microsoft.com/en-us/microsoft-edge/webview2/how-to/webresourcerequested?tabs=dotnet]

• You can consider serving everything locally using file:// or localhost, and make sure no external URLs are referenced.

Would the above work in your app scenario?

[thongw]

Hi @Lakshmisha-KS ,
Just want to clarify some questions,

1. When using WebView2 to host a dialog, is msedgewebview2.exe being spawned as a child process expected?
2. Does msedgewebview2.exe send any traffic (eg. telemetry or analytics etc.) back to Microsoft? If so, is there any documentation on exactly what is being sent?

Just want to have confirmation on these to plan the next steps that we should take.

Thank you!

[gourabkmsft]

Hi @thongw ,

1. Yes, this is expected. The msedgewebview2.exe will be launched as a child of the host process (if the User Data Folder is not shared with any other process).
2. WebView2 does send some optional and required diagnotic data to keep WebView2 secure and up to date, diagnose issues, and improve WebView2. Please find more details documented at https://learn.microsoft.com/en-us/microsoft-edge/webview2/concepts/data-privacy?tabs=dotnetcsharp

[thongw]

Hi @gourabkmsft,
For your forementioned point 2 about diagnostics data collection, does @Lakshmisha-KS 's suggestion apply to these type of traffic?

[gourabkmsft]

No, the suggestions provided by @Lakshmisha-KS will work for requests made within the WebView2 context (navigation, WebResourceRequested etc.), but the diagnostics fall outside the scope of it.
The diagnotics collection from WebView2 is tied to the users' Windows settings. There was a similar discussion in this thread which might be useful.

[ivantcp]

@gourabkmsft, we have customers that requires strict dark-site environment and currently WebView2's required diagnostic data is considered as unexpected internet traffic. Is there a way for us to configure disabling of such diagnostic data collection for such customers? There are alot of benefits for us to use WebView2 and we hate to move to an alternative 3rd party tool just for this use case. Will appreciate if WebView2 team can consider this request.

[koenvd]

Think you can provide an additional browser argument to Webview2 as --disable-features=msSmartScreenProtection to get rid of it ...