---
title: "Keep web views to your own pages · Agent Wranglers"
url: https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/locked-web-views
id: MOB-46
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 962
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep web views to your own pages

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Network, links and web views](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: MOB-46
- Level: Recommended
- Chapter: [Network, links and web views](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views.md)
- Rule: A web view inside the app loads only pages from an allowlist of your own https origins. Bridges from JavaScript to native code are present only while one of those pages is loaded.
- Check: A test loads an outside URL in each web view and the page opens in the system browser instead. A test page from an origin outside the allowlist finds no native bridge object.
- How: A JavaScript bridge, such as `addJavascriptInterface` on Android or a script message handler on iOS, reaches every frame of the page. A hostile ad, an injected script or a link to an outside site then calls native code with the app's permissions. Leave JavaScript off when the page is static. Open every link outside the allowlist in the system browser. Turn off file access from web content on Android with `setAllowFileAccess(false)`. Accept web messages only from a named origin, never `*`. Pages shown in the web view follow [allow only the scripts you wrote](https://agentwranglers.se/playbook/application-security/browser-security-headers/content-security-policy.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Kotlin example

```kotlin
private val allowedHosts = setOf("help.example.com")

webView.settings.allowFileAccess = false
webView.webViewClient = object : WebViewClient() {
    override fun shouldOverrideUrlLoading(view: WebView, request: WebResourceRequest): Boolean {
        val url = request.url
        if (url.scheme == "https" && url.host in allowedHosts) return false
        startActivity(Intent(Intent.ACTION_VIEW, url))
        return true
    }
}
```

### Plain text example

```swift
let allowedHosts: Set<String> = ["help.example.com"]

func webView(_ webView: WKWebView, decidePolicyFor action: WKNavigationAction,
             decisionHandler: @escaping (WKNavigationActionPolicy) -> Void) {
    guard let url = action.request.url else { return decisionHandler(.cancel) }
    if url.scheme == "https", let host = url.host, allowedHosts.contains(host) { return decisionHandler(.allow) }
    UIApplication.shared.open(url)
    decisionHandler(.cancel)
}
```

## Sources

- [OWASP MASVS-PLATFORM-2](https://mas.owasp.org/MASVS/controls/MASVS-PLATFORM-2/)
- [Android, Insecure WebView native bridges](https://developer.android.com/privacy-and-security/risks/insecure-webview-native-bridges)

## Related rules

- APS-25 [Allow only the scripts you wrote](https://agentwranglers.se/playbook/application-security/browser-security-headers/content-security-policy.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/locked-web-views">Agent Wranglers mobile apps playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Allow no cleartext traffic from the app](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/no-cleartext-traffic.md)
- [Network, links and web views](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views.md)