{"id":3313,"date":"2019-12-09T20:13:49","date_gmt":"2019-12-09T18:13:49","guid":{"rendered":"https:\/\/blog.tomayac.com\/2019\/12\/09\/inspecting-facebooks-webview\/"},"modified":"2019-12-09T20:13:49","modified_gmt":"2019-12-09T18:13:49","slug":"inspecting-facebooks-webview","status":"publish","type":"post","link":"https:\/\/tomayac.com\/wordpress\/2019\/12\/09\/inspecting-facebooks-webview\/","title":{"rendered":"Inspecting Facebook’s WebView"},"content":{"rendered":"\n\t\t\t

Both\nFacebook's Android app<\/a>\nas well as\nFacebook's iOS app<\/a> use a so-called in-app browser,\nsometimes also referred to as IAB.\nThe core argument for using an in-app browser (instead of the user's default browser)\nis to keep users in the app and to enable closer app integration patterns\n(like "quote from a page in a new Facebook post"), while making others harder or even impossible\n(like "share this link to Twitter").\nTechnically, IABs are implemented as\nWebView<\/code><\/a>s on Android,\nrespectively as\nWKWebView<\/code><\/a>s on iOS.\nTo simplify things, from hereon, I will refer to both simply as WebViews<\/em>.<\/p>\n

In-App Browsers are less capable than real browsers \u2693<\/a><\/h2>\n

Turns out, WebViews are rather limited compared to real browsers like Firefox, Edge, Chrome,\nand to some extent also Safari.\nIn the past, I have done some research<\/a>\non their limitations when it comes to features that are important in the context of Progressive Web Apps.\nThe linked paper has all the details, but you can simply see for yourself by opening\nthe \ud83d\udd75\ufe0f PWA Feature Detector <\/a> app\nthat I have developed for this research in your regular browser,\nand then in a WebView like Facebook's in-app browser (you can share the\nlink<\/a> visible to just yourself on Facebook\nand then click through, or try to open my\npost<\/a> in the app).<\/p>\n

In-App Browsers can modify webpages \u2693<\/a><\/h2>\n

On top of limited features, WebViews can<\/em> also be used for effectively conducting intended\nman-in-the-middle attacks<\/a>,\nsince the IAB developer can arbitrarily\ninject JavaScript code<\/a>\nand also\nintercept network traffic<\/a>.\nMost of the time, this feature is used for good.\nFor example, an airline company might reuse the \ud83d\udcba airplane seat selector logic\non both their native app as well as on their Web app.\nIn their native app, they would remove things like the header and the footer,\nwhich they then would show on the Web (this is likely the origin of the\nCSS can kill you<\/a> meme).<\/p>\n

If you build an IAB, don't use a WebView \u2693<\/a><\/h2>\n

For these reasons, people like Alex Russell<\/a>\u2014whom\nyou should definitely follow\u2014have been advocating against WebView-based IABs.\nInstead, you should wherever possible use\nChrome Custom Tabs<\/a> on Android,\nor the iOS counterpart\nSFSafariViewController<\/code><\/a>.\nAlex writes<\/a>:<\/p>\n

\n

Note that responsible native apps have<\/em> a way of creating an "in app browser" that doesn't subvert user choice or break the web:<\/p>\n

https:\/\/developer.chrome.com\/multidevice\/android\/customtabs<\/a><\/p>\n

Any browser can implement the protocol & default browser will be used. FB can enable this with their next update.<\/p>\n<\/blockquote>\n

If you have to use a WebView-based IAB, mark it debuggable \u2693<\/a><\/h2>\n

Alex has been telling people for a long time that they should\nmark their WebView-based IABs debuggable<\/a>.\nThe actual code for that is a one-liner:<\/p>\n

if<\/span> (<\/span>Build<\/span>.<\/span>VERSION.<\/span>SDK_INT >=<\/span> Build<\/span>.<\/span>VERSION_CODES.<\/span>KITKAT)<\/span> {<\/span>
    WebView<\/span>.<\/span>setWebContentsDebuggingEnabled<\/span>(<\/span>true<\/span>)<\/span>;<\/span>
}<\/span><\/code><\/pre>\n
Looking into Facebook's IAB \u2693<\/a><\/h2>\n
The other day, I learned with great joy that Facebook finally have marked their IAB debuggable \ud83c\udf89.\nPatrick Meenan<\/a>\u2014whom you should likewise follow\nand whom you might know from the amazing WebPageTest<\/a>\nproject\u2014writes<\/a> in a Twitter thread:<\/p>\n
\n
You can now remote-debug sites in the Facebook in-app browser on Android.\nIt is enabled automatically so once your device is in dev mode with USB debugging\nand a browser open just visit chrome:\/\/inspect to attach to the WebView.<\/p>\n<\/blockquote>\n
\n
The browser (on iOS and Android) is just a WebView so it should behave\nmostly like Chrome and Safari but it adds some identifiers to the UA string\nwhich sometimes causes pages that UA sniff to break.<\/p>\n<\/blockquote>\n
\n
Finally, if your analytics aren't breaking out the in-app browsers for you,\nI highly recommend you see if it is possible to enable.\nYou might be shocked at how much of your traffic comes from an in-app browser\n(odds are it is the 3rd most common browser behind Chrome and Safari).<\/p>\n<\/blockquote>\n
I have thus followed up on the invitation and had a closer look at their IAB by inspecting\nexample.org<\/a> and also a simple test page\nfacebook-debug.glitch.me<\/a> that contains the\ndebugger<\/code><\/a>\nstatement in its head.\nI have linked a debug trace<\/a> \ud83d\udcc4 that you can open for yourself\nin the Performance tab of the Chrome DevTools.<\/p>\n
User-Agent String \u2693<\/a><\/h3>\n
As pre-announced by Patrick, Facebook's IAB changes the user-agent<\/code> string.\nThe\ndefault WebView user-agent<\/code> string<\/a>\nlooks something like Mozilla\/5.0 (Linux; Android 5.1.1; Nexus 5 Build\/LMY48B; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/43.0.2357.65 Mobile Safari\/537.36<\/code>\nFacebook's IAB browser currently sends this:<\/p>\n
navigator.<\/span>userAgent
\/\/ \"Mozilla\/5.0 (Linux; Android 10; Pixel 3a Build\/QQ2A.191125.002; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/78.0.3904.108 Mobile Safari\/537.36 [FB_IAB\/FB4A;FBAV\/250.0.0.14.241;]\"<\/span><\/code><\/pre>\n
Compared to the default user-agent<\/code> string, the identifying bit is the suffix [FB_IAB\/FB4A;FBAV\/250.0.0.14.241;]<\/code>.<\/p>\n
Added window<\/code> properties \u2693<\/a><\/h3>\n
Facebook's IAB adds two new properties to window<\/code>, with the values 0<\/code> and 1<\/code>.<\/p>\n
window.<\/span>TEMPORARY<\/span>
\/\/ 0<\/span>
window.<\/span>PERSISTENT<\/span>
\/\/ 1<\/span><\/code><\/pre>\n
Added window<\/code> object \u2693<\/a><\/h3>\n
Facebook further adds a new window<\/code> object FbQuoteShareJSInterface<\/code>.<\/p>\n
document.<\/span>onselectionchange<\/span> =<\/span> function<\/span>(<\/span>)<\/span> {<\/span>
  window.<\/span>FbQuoteShareJSInterface.<\/span>onSelectionChange<\/span>(<\/span>
    window.<\/span>getSelection<\/span>(<\/span>)<\/span>.<\/span>toString<\/span>(<\/span>)<\/span>,<\/span>
    window.<\/span>location.<\/span>href
  )<\/span>;<\/span>
}<\/span>;<\/span><\/code><\/pre>\n
This code is used for the "share quote" feature that allows users to mark text on a page to share.<\/p>\n
\"Facebook's<\/p>\n
Performance monitoring and feature detection \u2693<\/a><\/h3>\n
Facebook runs some performance monitoring via the\nPerformance<\/code><\/a> interface.\nThis is split up in two scripts, each of which they seem to run three times.\nThey also check if a given page is using AMP<\/a>\nby checking for the presence of the amp<\/code> or \u26a1\ufe0f<\/code> attribute on <html><\/code>.<\/p>\n
void<\/span> (<\/span>function<\/span>(<\/span>)<\/span> {<\/span>
  try<\/span> {<\/span>
    if<\/span> (<\/span>window.<\/span>location.<\/span>href ===<\/span> \"about:blank\"<\/span>)<\/span> {<\/span>
      return<\/span>;<\/span>
    }<\/span>
    if<\/span> (<\/span>
      !<\/span>window.<\/span>performance ||<\/span>
      !<\/span>window.<\/span>performance.<\/span>timing ||<\/span>
      !<\/span>document ||<\/span>
      !<\/span>document.<\/span>body ||<\/span>
      document.<\/span>body.<\/span>scrollHeight <=<\/span> 0<\/span> ||<\/span>
      !<\/span>document.<\/span>body.<\/span>children ||<\/span>
      document.<\/span>body.<\/span>children.<\/span>length <<\/span> 1<\/span>
    )<\/span> {<\/span>
      return<\/span>;<\/span>
    }<\/span>
    var<\/span> nvtiming__fb_t =<\/span> window.<\/span>performance.<\/span>timing;<\/span>
    if<\/span> (<\/span>nvtiming__fb_t.<\/span>responseEnd ><\/span> 0<\/span>)<\/span> {<\/span>
      console.<\/span>log<\/span>(<\/span>\"FBNavResponseEnd:\"<\/span> +<\/span> nvtiming__fb_t.<\/span>responseEnd)<\/span>;<\/span>
    }<\/span>
    if<\/span> (<\/span>nvtiming__fb_t.<\/span>domContentLoadedEventStart ><\/span> 0<\/span>)<\/span> {<\/span>
      console.<\/span>log<\/span>(<\/span>
        \"FBNavDomContentLoaded:\"<\/span> +<\/span> nvtiming__fb_t.<\/span>domContentLoadedEventStart
      )<\/span>;<\/span>
    }<\/span>
    if<\/span> (<\/span>nvtiming__fb_t.<\/span>loadEventEnd ><\/span> 0<\/span>)<\/span> {<\/span>
      console.<\/span>log<\/span>(<\/span>\"FBNavLoadEventEnd:\"<\/span> +<\/span> nvtiming__fb_t.<\/span>loadEventEnd)<\/span>;<\/span>
    }<\/span>
    var<\/span> nvtiming__fb_html =<\/span> document.<\/span>getElementsByTagName<\/span>(<\/span>\"html\"<\/span>)<\/span>[<\/span>0<\/span>]<\/span>;<\/span>
    if<\/span> (<\/span>nvtiming__fb_html)<\/span> {<\/span>
      var<\/span> nvtiming__fb_html_amp =<\/span>
        nvtiming__fb_html.<\/span>hasAttribute<\/span>(<\/span>\"amp\"<\/span>)<\/span> ||<\/span>
        nvtiming__fb_html.<\/span>hasAttribute<\/span>(<\/span>\"\\u26A1\"<\/span>)<\/span>;<\/span>
      console.<\/span>log<\/span>(<\/span>\"FBNavAmpDetect:\"<\/span> +<\/span> nvtiming__fb_html_amp)<\/span>;<\/span>
    }<\/span>
  }<\/span> catch<\/span> (<\/span>err)<\/span> {<\/span>
    console.<\/span>log<\/span>(<\/span>\"fb_navigation_timing_error:\"<\/span> +<\/span> err.<\/span>message)<\/span>;<\/span>
  }<\/span>
}<\/span>)<\/span>(<\/span>)<\/span>;<\/span>
\/\/ FBNavResponseEnd:1575904580720<\/span>
\/\/ FBNavDomContentLoaded:1575904586057<\/span>
\/\/ FBNavAmpDetect:false<\/span><\/code><\/pre>\n
document.<\/span>addEventListener<\/span>(<\/span>\"DOMContentLoaded\"<\/span>,<\/span> event<\/span> =><\/span> {<\/span>
  console.<\/span>info<\/span>(<\/span>
    \"FBNavDomContentLoaded:\"<\/span> +<\/span>
      window.<\/span>performance.<\/span>timing.<\/span>domContentLoadedEventStart
  )<\/span>;<\/span>
}<\/span>)<\/span>;<\/span>
\/\/ FBNavDomContentLoaded:1575904586057<\/span><\/code><\/pre>\n
Feature Policy tests \u2693<\/a><\/h2>\n
They run some Feature Policy<\/a>\ntests via a function named getFeaturePolicyAllowListOnPage()<\/code>.\nYou can see the documentation for the tested\ndirectives<\/a>\non the Mozilla Developer Network.<\/p>\n
(<\/span>function<\/span>(<\/span>)<\/span> {<\/span>
  function<\/span> getFeaturePolicyAllowListOnPage<\/span>(<\/span>features<\/span>)<\/span> {<\/span>
    const<\/span> map =<\/span> {<\/span>}<\/span>;<\/span>
    const<\/span> featurePolicy =<\/span> document.<\/span>policy ||<\/span> document.<\/span>featurePolicy;<\/span>
    for<\/span> (<\/span>const<\/span> feature of<\/span> features)<\/span> {<\/span>
      map[<\/span>feature]<\/span> =<\/span> {<\/span>
        allowed:<\/span> featurePolicy.<\/span>allowsFeature<\/span>(<\/span>feature)<\/span>,<\/span>
        allowList:<\/span> featurePolicy.<\/span>getAllowlistForFeature<\/span>(<\/span>feature)<\/span>
      }<\/span>;<\/span>
    }<\/span>
    return<\/span> map;<\/span>
  }<\/span>
  const<\/span> allPolicies =<\/span> [<\/span>
    \"geolocation\"<\/span>,<\/span>
    \"midi\"<\/span>,<\/span>
    \"ch-ect\"<\/span>,<\/span>
    \"execution-while-not-rendered\"<\/span>,<\/span>
    \"layout-animations\"<\/span>,<\/span>
    \"vertical-scroll\"<\/span>,<\/span>
    \"forms\"<\/span>,<\/span>
    \"oversized-images\"<\/span>,<\/span>
    \"document-access\"<\/span>,<\/span>
    \"magnetometer\"<\/span>,<\/span>
    \"picture-in-picture\"<\/span>,<\/span>
    \"modals\"<\/span>,<\/span>
    \"unoptimized-lossless-images-strict\"<\/span>,<\/span>
    \"accelerometer\"<\/span>,<\/span>
    \"vr\"<\/span>,<\/span>
    \"document-domain\"<\/span>,<\/span>
    \"serial\"<\/span>,<\/span>
    \"encrypted-media\"<\/span>,<\/span>
    \"font-display-late-swap\"<\/span>,<\/span>
    \"unsized-media\"<\/span>,<\/span>
    \"ch-downlink\"<\/span>,<\/span>
    \"ch-ua-arch\"<\/span>,<\/span>
    \"presentation\"<\/span>,<\/span>
    \"xr-spatial-tracking\"<\/span>,<\/span>
    \"lazyload\"<\/span>,<\/span>
    \"idle-detection\"<\/span>,<\/span>
    \"popups\"<\/span>,<\/span>
    \"scripts\"<\/span>,<\/span>
    \"unoptimized-lossless-images\"<\/span>,<\/span>
    \"sync-xhr\"<\/span>,<\/span>
    \"ch-width\"<\/span>,<\/span>
    \"ch-ua-model\"<\/span>,<\/span>
    \"top-navigation\"<\/span>,<\/span>
    \"ch-lang\"<\/span>,<\/span>
    \"camera\"<\/span>,<\/span>
    \"ch-viewport-width\"<\/span>,<\/span>
    \"loading-frame-default-eager\"<\/span>,<\/span>
    \"payment\"<\/span>,<\/span>
    \"pointer-lock\"<\/span>,<\/span>
    \"focus-without-user-activation\"<\/span>,<\/span>
    \"downloads-without-user-activation\"<\/span>,<\/span>
    \"ch-rtt\"<\/span>,<\/span>
    \"fullscreen\"<\/span>,<\/span>
    \"autoplay\"<\/span>,<\/span>
    \"execution-while-out-of-viewport\"<\/span>,<\/span>
    \"ch-dpr\"<\/span>,<\/span>
    \"hid\"<\/span>,<\/span>
    \"usb\"<\/span>,<\/span>
    \"wake-lock\"<\/span>,<\/span>
    \"ch-ua-platform\"<\/span>,<\/span>
    \"ambient-light-sensor\"<\/span>,<\/span>
    \"gyroscope\"<\/span>,<\/span>
    \"document-write\"<\/span>,<\/span>
    \"unoptimized-lossy-images\"<\/span>,<\/span>
    \"sync-script\"<\/span>,<\/span>
    \"ch-device-memory\"<\/span>,<\/span>
    \"orientation-lock\"<\/span>,<\/span>
    \"ch-ua\"<\/span>,<\/span>
    \"microphone\"<\/span>
  ]<\/span>;<\/span>
  return<\/span> getFeaturePolicyAllowListOnPage<\/span>(<\/span>allPolicies)<\/span>;<\/span>
}<\/span>)<\/span>(<\/span>)<\/span>;<\/span><\/code><\/pre>\n
Not all directives are currently supported by the WebView, so a number of warnings are logged.\nThe recognized ones (i.e., the output of the getFeaturePolicyAllowListOnPage()<\/code> function above)\nresult in an object as follows.<\/p>\n
{<\/span>
  \"geolocation\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"https:\/\/example.com\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"midi\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"https:\/\/example.com\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"ch-ect\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"execution-while-not-rendered\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"layout-animations\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"vertical-scroll\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"forms\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"oversized-images\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"document-access\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"magnetometer\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"https:\/\/example.com\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"picture-in-picture\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"*\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"modals\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"unoptimized-lossless-images-strict\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"accelerometer\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"https:\/\/example.com\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"vr\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"https:\/\/example.com\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"document-domain\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"*\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"serial\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"encrypted-media\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"https:\/\/example.com\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"font-display-late-swap\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"unsized-media\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"ch-downlink\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"ch-ua-arch\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"presentation\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"xr-spatial-tracking\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"lazyload\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"idle-detection\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"popups\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"scripts\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"unoptimized-lossless-images\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"sync-xhr\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"*\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"ch-width\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"ch-ua-model\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"top-navigation\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"ch-lang\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"camera\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"https:\/\/example.com\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"ch-viewport-width\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"loading-frame-default-eager\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"payment\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"pointer-lock\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"focus-without-user-activation\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"downloads-without-user-activation\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"ch-rtt\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"fullscreen\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"https:\/\/example.com\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"autoplay\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"https:\/\/example.com\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"execution-while-out-of-viewport\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"ch-dpr\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"hid\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"usb\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"https:\/\/example.com\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"wake-lock\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"ch-ua-platform\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"ambient-light-sensor\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"https:\/\/example.com\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"gyroscope\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"https:\/\/example.com\"<\/span>
    ]<\/span>
  }<\/span>,<\/span>
  \"document-write\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"unoptimized-lossy-images\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"sync-script\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"ch-device-memory\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"orientation-lock\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"ch-ua\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> false<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>]<\/span>
  }<\/span>,<\/span>
  \"microphone\"<\/span>:<\/span> {<\/span>
    \"allowed\"<\/span>:<\/span> true<\/span>,<\/span>
    \"allowList\"<\/span>:<\/span> [<\/span>
      \"https:\/\/example.com\"<\/span>
    ]<\/span>
  }<\/span>
}<\/span><\/code><\/pre>\n
Request header \u2693<\/a><\/h3>\n
:authority: facebook-debug.glitch.me\n:method: GET\n:path: \/\n:scheme: https\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3\naccept-encoding: gzip, deflate\naccept-language: en-US,en;q=0.9,de-DE;q=0.8,de;q=0.7,ca-ES;q=0.6,ca;q=0.5\ncache-control: no-cache\npragma: no-cache\nreferer: http:\/\/m.facebook.com\/\nsec-fetch-mode: navigate\nsec-fetch-site: none\nsec-fetch-user: ?1\nupgrade-insecure-requests: 1\nuser-agent: Mozilla\/5.0 (Linux; Android 10; Pixel 3a Build\/QQ2A.191125.002; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/78.0.3904.108 Mobile Safari\/537.36 [FB_IAB\/FB4A;FBAV\/250.0.0.14.241;]\nx-requested-with: com.facebook.katana\n<\/code><\/pre>\n
Response header \u2693<\/a><\/h3>\n
accept-ranges: bytes\ncache-control: max-age=0\ncontent-length: 527\ncontent-type: text\/html; charset=utf-8\ndate: Mon, 09 Dec 2019 15:23:40 GMT\netag: W\/"20f-16eeb283880"\nlast-modified: Mon, 09 Dec 2019 14:55:12 GMT\nstatus: 200\nvary: Origin\n<\/code><\/pre>\n
Conclusion \u2693<\/a><\/h2>\n
All in all, these are all the things Facebook did that I could observe\non the pages that I have tested.\nI didn't notice any click listeners or scroll listeners\n(that could be used for engagement tracking of Facebook users with the pages they browse on)\nor any other kind of "phoning home" functionality,\nbut they could<\/em> of course have implemented this natively\nvia the WebView's\nView.OnScrollChangeListener<\/code><\/a>\nor\nView.OnClickListener<\/code><\/a>,\nas they\ndid<\/a>\nfor long clicks for the FbQuoteShareJSInterface<\/code><\/a>.<\/p>\n
That being said, if after reading this you prefer your links to open in your default browser,\nit's well hidden, but definitely possible: Settings > Media and Contacts > Links open externally<\/code>.<\/p>\n
\"Facebook<\/p>\n
It goes without saying, but just in case:\nall code snippets in this post are owned by and copyright of Facebook<\/em>.<\/p>\n
Did you run a similar analysis with similar (or maybe different) findings?\nLet me know on Twitter or Mastodon by posting your thoughts with a link to this post<\/a>.\nIt will then show up as a Webmention at the bottom.\nOn supporting platforms, you can simply use the "Share Article" button below.<\/p>\n\n\t\t\t
\n\t\t\t\t\"Thomas\n\t\t\t\tThis post appeared first on https:\/\/blog.tomayac.com\/2019\/12\/09\/inspecting-facebooks-webview\/<\/a>.\n\t\t\t<\/p>\n\t\t","protected":false},"excerpt":{"rendered":"
\t\t\tBoth
\nFacebook’s Android app
\nas well as
\nFacebook’s iOS app use a so-called in-app browser,
\nsometimes also referred to as IAB.
\nThe core argument for using an in-app browser (instead of the user’s default browser)
\nis to keep users in the app and to en…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"intlwemo_wallet_address":"","footnotes":""},"categories":[],"tags":[],"class_list":["post-3313","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/tomayac.com\/wordpress\/wp-json\/wp\/v2\/posts\/3313","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tomayac.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tomayac.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tomayac.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tomayac.com\/wordpress\/wp-json\/wp\/v2\/comments?post=3313"}],"version-history":[{"count":1,"href":"https:\/\/tomayac.com\/wordpress\/wp-json\/wp\/v2\/posts\/3313\/revisions"}],"predecessor-version":[{"id":3314,"href":"https:\/\/tomayac.com\/wordpress\/wp-json\/wp\/v2\/posts\/3313\/revisions\/3314"}],"wp:attachment":[{"href":"https:\/\/tomayac.com\/wordpress\/wp-json\/wp\/v2\/media?parent=3313"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tomayac.com\/wordpress\/wp-json\/wp\/v2\/categories?post=3313"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tomayac.com\/wordpress\/wp-json\/wp\/v2\/tags?post=3313"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
HTTP headers \u2693<\/a><\/h2>\n
I checked the response and request headers, but nothing special stood out.\nThe only remarkable thing given that they look at Feature Policy is the absence<\/em> of the\nFeature-Policy<\/code> header<\/a>.<\/p>\n