Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Port MASTG-TEST-0032: Testing WebView Protocol Handlers (android) #3177

Open
wants to merge 58 commits into
base: master
Choose a base branch
from

Conversation

cpholguera
Copy link
Collaborator

@cpholguera cpholguera commented Feb 23, 2025

This PR closes #2978.

Deprecates:

  • MASTG-TEST-0032

Adds:

  • MASTG-TEST-0250

  • MASTG-TEST-0251

  • MASTG-TEST-0252

  • MASTG-TEST-0253

  • MASTG-DEMO-0029

  • MASTG-DEMO-0030

  • MASTG-DEMO-0031

  • MASTG-DEMO-0032

…PI versions and link to the new best practice file.
…ess, detailing security implications and configuration examples.
@cpholguera cpholguera requested a review from TheDauntless March 11, 2025 09:45
@cpholguera cpholguera marked this pull request as ready for review March 11, 2025 09:45
Copy link
Collaborator

@javier-ruiz-b javier-ruiz-b left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe this fixes the issue

</html>
```

##### `setAllowUniversalAccessFromFileURLs`
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider adding:

Setting `setAllowUniversalAccessFromFileURLs(true)` allows JavaScript inside a local `file://` to make cross-origin requests (XHR, Fetch, etc.). This bypasses the Same-Origin Policy (SOP) for network requests, but it does not grant access to cookies from remote websites.

Cookies are managed by the WebView’s CookieManager and cannot be accessed by a `file://` origin unless explicitly allowed via document.cookie (which most modern sites prevent using `HttpOnly` and `Secure` flags).

Cross-origin requests also do not include cookies unless explicitly allowed by the server via CORS headers such as `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Credentials: true`.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

MASTG v1->v2 MASTG-TEST-0032: Testing WebView Protocol Handlers (android)
2 participants