Questions tagged [webview]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
7 views

Is there a way to prevent my website to be viewed over the webView of mobile apps? [migrated]

I have noticed that some mobile app utilizes webview to display and process information. For instance, this mobile app asks username/password as part of its registration process, then creates a user ...
1
vote
1answer
118 views

Isn't HTTPS enough to prevent MITM in mobile apps? Why is SSL Pinning needed?

I am making a webview that is going to be part of a native iOS and Android app, I implemented the webview using HTTPS as a protocol, and developed my NodeJS app there. But the security team from where ...
0
votes
0answers
52 views

Understanding the Webview (html) code coming from the server

I am using an Android app downloaded from playstore and wanted to know whether the app uses Webview. So, I tried intercepting the network calls with the help of Charles (proxy) and I found out that ...
0
votes
0answers
34 views

Potential risk of allow login sites to be accessible through webview

I know that allowing site (especially login site) to be accessible by iframe is a bad practice. But I plan to use webView to "outsource" the login process in a mobile app to a website (owned ...
1
vote
1answer
29 views

Is this url verification with startsWith secure?

I would like to know if this code is secure to validate that a url is from my domain before loading it a webview in android : if (!url.startsWith("https://www.example.com/test/")){ // don't load ...
1
vote
1answer
66 views

What is the impact of controling the content of a webview in Android?

I'm learning android application pen testing and I'm kinda lost about what can do an attacker that control the content of a webview ? I guess if there is no javascript enabled there is no impact, ...
1
vote
1answer
3k views

How would someone XSS into a WebView?

There are several articles about XSS vulnerabilities in Android/iOS WebViews. By WebView I mean the 'real' webview not SFSafariViewController or Chrome Custom Tabs. I understand the main concept of ...
0
votes
1answer
1k views

Why does my Cordova app contain an SQLite file with credit card tables?

We have created a mobile app that includes a view for payment with credit cards. We have used Cordova so we can pusblish our app for Android and iOS. During some tests an SQLite file was found on /...
1
vote
0answers
1k views

HTTP security headers for native and webview based mobile applications

OWASP Security Headers Project recommends the following security headers for web applications. Out of the following which headers are relevant to mobile applications? HTTP Strict Transport Security (...