WebView security

Security Mid-level Kotlin 2.0+ API 24+ Reviewed By Best Latest Apps

Pick the fix

A WebView with a JS bridge that returns the auth token navigates to any link the user taps. What's the most important fix?

Options
Hint 1 of 1

Who can call the bridge?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A Restrict loads to trusted origins in shouldOverrideUrlLoading and remove the token from the bridge

Correct. Any page that loads can call the bridge, so limit both.

Why not the others?
  • B Disable zoom. Not related.
  • C Use a bigger WebView cache. Not related.
  • D Call handler.proceed() on SSL errors. That makes it worse.

30-second answer

WebView runs web content inside your app. Risks: JavaScript bridges (addJavascriptInterface) exposing app functions to any loaded page, file access letting pages read local files, loading untrusted URLs, and mixed content. Enable JavaScript only when needed, load only trusted origins, use WebViewAssetLoader for local content instead of file URLs, and keep Safe Browsing on.

Practise saying it · 30 s. No recording, just a timer

Explain WebView risks.

Say your answer out loud, then check which of these points you covered:

  • JS bridge exposure
  • File access
  • Restrict URLs
  • Asset loader, Safe Browsing
  • Custom Tabs

Deep dive

Only methods marked @JavascriptInterface are exposed, but any page in the WebView can call them.

allowFileAccess defaults to false when targeting API 30+.

Check the URL in shouldOverrideUrlLoading and open external links in the browser.

For simple web pages, Custom Tabs are safer and share the browser's login.

Common mistakes

  • A JS bridge exposing token or file APIs while loading any URL.
  • Using file:// URLs with universal access.
  • Ignoring SSL errors with handler.proceed().

Senior take & follow-ups

Name the bridge risk first, then file access and URL control.

Follow-up questions

Think of your answer first, then open the hint.

  1. When would you use Custom Tabs instead?

    Show hint

    To show third-party pages or OAuth login without hosting them in your app.

  2. What does WebViewAssetLoader do?

    Show hint

    Serves local files from an https URL so the same-origin policy applies.

Related questions

Suggest a fix if something here is wrong or out of date.