corsAllowlist property

List<String>? corsAllowlist
getter/setter pair

Sets the CORS allowlist for this WebView.

URI patterns must be of the form [protocol]://[host]:[port], where each component may contain the wildcard character (*) to match zero or more characters. All three components are required.

Disabling CORS checks permits resources from other origins to load allowlisted resources. It does NOT permit the allowlisted resources to load resources from other origins.

Setting to null or an empty list clears the allowlist.

Example patterns:

  • https://example.com:* - All ports on example.com over HTTPS
  • *://api.myservice.com:* - Any protocol on api.myservice.com
  • https://*.example.com:443 - HTTPS port 443 on any subdomain

Officially Supported Platforms/Implementations:

Implementation

List<String>? corsAllowlist;