WebView Security

WebViews require special attention as they can introduce web vulnerabilities into mobile apps.

// Secure WebView implementation
import android.webkit.*
import android.os.Build
import androidx.annotation.RequiresApi

class SecureWebViewManager {
    
    @RequiresApi(Build.VERSION_CODES.O)
    fun configureSecureWebView(webView: WebView) {
        val settings = webView.settings
        
        // Disable dangerous features
        settings.javaScriptEnabled = false // Enable only if necessary
        settings.allowFileAccess = false
        settings.allowContentAccess = false
        settings.allowFileAccessFromFileURLs = false
        settings.allowUniversalAccessFromFileURLs = false
        
        // Security settings
        settings.mixedContentMode = WebSettings.MIXED_CONTENT_NEVER_ALLOW
        settings.domStorageEnabled = false
        settings.databaseEnabled = false
        settings.setGeolocationEnabled(false)
        
        // Safe browsing
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
            settings.safeBrowsingEnabled = true
        }
        
        // Configure WebViewClient for URL filtering
        webView.webViewClient = SecureWebViewClient()
        
        // Configure WebChromeClient for permission handling
        webView.webChromeClient = SecureWebChromeClient()
    }
    
    class SecureWebViewClient : WebViewClient() {
        private val allowedDomains = listOf("example.com", "trusted-site.com")
        
        override fun shouldOverrideUrlLoading(view: WebView?, request: WebResourceRequest?): Boolean {
            val url = request?.url ?: return true
            
            // Only allow HTTPS
            if (url.scheme != "https") {
                return true // Block non-HTTPS
            }
            
            // Check allowed domains
            val host = url.host ?: return true
            if (!allowedDomains.any { host.endsWith(it) }) {
                return true // Block unauthorized domain
            }
            
            return false // Allow loading
        }
        
        override fun onReceivedSslError(view: WebView?, handler: SslErrorHandler?, error: SslError?) {
            // Never ignore SSL errors in production
            handler?.cancel()
        }
    }
    
    class SecureWebChromeClient : WebChromeClient() {
        override fun onGeolocationPermissionsShowPrompt(origin: String?, callback: GeolocationPermissions.Callback?) {
            // Deny all geolocation requests
            callback?.invoke(origin, false, false)
        }
        
        override fun onPermissionRequest(request: PermissionRequest?) {
            // Deny all permission requests
            request?.deny()
        }
    }
}

Android's security model provides powerful tools for protecting applications and user data. By properly implementing these security features—from secure storage and network communications to runtime permissions and anti-tampering measures—developers can create Android applications that resist attacks while providing excellent user experiences. The key is understanding Android's unique security challenges and leveraging platform capabilities appropriately. The next chapter will explore cross-platform approaches to secure data storage and encryption.## Secure Data Storage and Encryption

Data is the lifeblood of mobile applications, and protecting it requires comprehensive encryption strategies and secure storage practices. This chapter explores the principles and practical implementation of data security in mobile applications, covering everything from basic encryption concepts to advanced techniques for protecting sensitive information across iOS and Android platforms.