KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #ai-agents #developer-tools #codex #claude-code #mcp #rust #deepseek-harness #typescript #ai-agent #cli

cordova-plugin-whitelist

★ 441 Open GitHub ↗

[DEPRECATED] Apache Cordova - Whitelist Plugin

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

---
title: Whitelist
description: Whitelist external content accessible by your app.
---

# cordova-plugin-whitelist

This plugin implements a whitelist policy for navigating the application webview on Cordova 4.0

### Deprecation Notice

With the Allow List functionality now integrated into the core of Cordova Android (10.x and greater), this plugin is no longer required.

Existing projects using Cordova Android 10 or greater should remove this plugin with the following command:

```bash
cordova plugin rm cordova-plugin-whitelist
```

## Installation

You can install whitelist plugin with Cordova CLI, from npm:

```
$ cordova plugin add cordova-plugin-whitelist
$ cordova prepare
```

## Supported Cordova Platforms

* Android 4.0.0 or above

## Navigation Whitelist

Controls which URLs the WebView itself can be navigated to. Applies to
top-level navigations only.

By default navigations are only allowed to `file://` URLs. To allow others URLs, you must add `<allow-navigation>` tags to your `config.xml`:

```xml

<allow-navigation href="http://example.com/*" />

<allow-navigation href="*://*.example.com/*" />

<allow-navigation href="*" />

<allow-navigation href="http://*/*" />
<allow-navigation href="https://*/*" />
<allow-navigation href="data:*" />
```

Quirks: on Android it also applies to iframes for non-http(s) schemes.

## Intent Whitelist

Controls which URLs the app is allowed to ask the system to open.

In `config.xml`, add `<allow-intent>` tags, like this:

```xml

<allow-intent href="http://*/*" />
<allow-intent href="https://*/*" />

<allow-intent href="http://example.com/*" />

<allow-intent href="*://*.example.com/*" />

<allow-intent href="sms:*" />

<allow-intent href="tel:*" />

<allow-intent href="geo:*" />

<allow-intent href="*" />
```

Without any `<allow-intent>` tags, no requests to external URLs are allowed. However, the default Cordova application includes a quite liberal set of `allow-intent` entries by default. It is advised to narrow this down based on each app's needs.

On Android, this equates to sending an intent of type BROWSEABLE.

This whitelist does not apply to plugins, only hyperlinks and calls to `window.open()`.

Note: `allow-navigation` takes precedence over `allow-intent`. Allowing navigation to all URLs with `<allow-navigation href="*" />` for example has the side effect of "capturing" all intents, so the webview navigates to them instead of triggering e.g. external apps.

## Network Request Whitelist

Controls which network requests (images, XHRs, etc) are allowed to be made (via cordova native hooks).

Note: We suggest you use a Content Security Policy (see below), which is more secure.  This whitelist is mostly historical for webviews which do not support CSP.

In `config.xml`, add `<access>` tags, like this:

```xml

<access origin="http://google.com" />
<access origin="https://google.com" />

<access origin="http://maps.google.com" />

<access origin="http://*.google.com" />

<access origin="content:///*" />

<access origin="*" />
```

Without any `<access>` tags, only requests to `file://` URLs are allowed. However, the default Cordova application includes `<access origin="*">` by default.

Note: Whitelist cannot block network redirects from a whitelisted remote website (i.e. http or https) to a non-whitelisted website. Use CSP rules to mitigate redirects to non-whitelisted websites for webviews that support CSP.

Quirk: Android also allows requests to https://ssl.gstatic.com/accessibility/javascript/android/ by default, since this is required for TalkBack to function properly.

### Content Security Policy

Controls which network requests (images, XHRs, etc) are allowed to be made (via webview directly).

On Android and iOS, the network request whitelist (see above) is not able to filter all types of requests (e.g. `<video>` & WebSockets are not blocked). So, in addition to the whitelist, you should use a [Content Security Policy](http://content-security-policy.com/) `<meta>` tag on all of your pages.

On Android, support for CSP within the system webview starts with KitKat (but is available on all versions using Crosswalk WebView).

Here are some example CSP declarations for your `.html` pages:

```html

<meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: https://ssl.gstatic.com; style-src 'self' 'unsafe-inline'; media-src *">

<meta http-equiv="Content-Security-Policy" content="default-src 'self' foo.com">

<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'">

<meta http-equiv="Content-Security-Policy" content="default-src 'self' https:">

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; frame-src 'self' https://cordova.apache.org">
```

cordova-plugin-whitelist

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README