Agent WranglersNetwork, links and web views
Traffic, sign-in and links cross from the app to the outside world. Use TLS, the system browser for sign-in, verified links and locked web views.
- Required 3
- Recommended 1
Required
Sign in through the system browser with PKCE
MOB-43Run OAuth and OpenID Connect sign-in in the system browser session, never in a web view inside the app. Every request uses PKCE, and the redirect goes to a claimed https address.
Open deep links only from verified domains
MOB-44Links that open screens or carry tokens use verified Universal Links and Android App Links on https addresses you own. The app checks every link parameter against an allowlist before acting on it.
Allow no cleartext traffic from the app
MOB-45Release builds send every request over TLS and trust only the system certificate authorities. They carry no global App Transport Security exception and no Android cleartext permission.
Recommended
Keep web views to your own pages
MOB-46A web view inside the app loads only pages from an allowlist of your own https origins. Bridges from JavaScript to native code are present only while one of those pages is loaded.
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views">Agent Wranglers mobile apps playbook</a>. In code you write, add a comment next to it with the same link.