WebView container support
A Hybrid App uses the native Mobile SDK together with an in-app WebView that loads a HUMAN-protected site. Native requests and WebView traffic must share the same VID.
This page lists which WebView containers setup supports. Use this instead of per-team guidance. For how to enable hybrid support, see Hybrid App integration.
Channel cascade
The SDK can move mobile data into the WebView on more than one channel. Two independent constraints cut the cascade down:
- The events and session-storage rungs need the SDK to hold a WebView instance. A wrapper-hosted WebView cannot provide that.
- Android does not have an events channel because it does not exist.
Only iOS 14+ native gets the full cascade. Reasserting cookies on navigation or foreground can recover a jar the host app cleared. This is recovery, not fallback. It does not survive a channel that is permanently cookie-hostile.
Root-scoped _pxmd and _pxwvm are readable from page JavaScript on WebKit and Chromium across cookies, session storage, and events (where the platform has that channel).
Support matrix
Expand a container for required configuration, active channel, limitations, and fallback.
Native
WKWebView
Supported: Yes
Required configuration: hybridAppPolicy.webRootDomains plus HumanSecurity.setupWebView, or iOS hybridAppPolicy.automaticSetup = true. Native supportExternalWebViews stays false.
Active channel: Events on iOS 14+ (preferred). On iOS 13, session storage then cookies.
Known limitations: Do not replace the SDK navigation delegate after setupWebView. Apple Pay on the Web may require allowJavaScriptEvaluation = false.
Fallback: iOS 14+: events → session storage → cookies → legacy. iOS 13: session storage → cookies → legacy (no events). See Channel cascade.
Android WebView
Supported: Yes
Required configuration: hybridAppPolicy.webRootDomains plus HumanSecurity.setupWebView. Native supportExternalWebViews stays false.
Active channel: Session storage, then cookies.
Known limitations: Events does not exist on Android. Do not replace the SDK WebViewClient after setupWebView.
Fallback: Session storage → cookies → legacy. Events does not exist. See Channel cascade.
Wrappers — flag on by default
These containers are wrapper-hosted, which means cookies are the only option followed by legacy (same cookie dependency). Events and session storage are unavailable and need a WebView instance. Android events does not exist.
react-native-webview
Supported: Yes
Required configuration: Set hybridAppPolicy.webRootDomains when starting the HUMAN React Native wrapper. The wrapper sets supportExternalWebViews = true for you.
Active channel: Cookies (wrapper-hosted).
Known limitations: The SDK has no WebView instance. Automatic interceptor is not supported in React Native.
Fallback: Cookies → legacy only. See Channel cascade.
Expo WebView
Supported: Yes
Required configuration: Set hybridAppPolicy.webRootDomains when starting the HUMAN Expo module. The module sets supportExternalWebViews = true for you.
Active channel: Cookies (wrapper-hosted).
Known limitations: Same instance constraint as other wrappers. Automatic interceptor is not supported in Expo.
Fallback: Cookies → legacy only. See Channel cascade.
Wrappers — set the flag yourself
Same wrapper-hosted cascade as above (cookies → legacy only). There is no wrapper-level default. Instead, set supportExternalWebViews = true in native start with webRootDomains.
Flutter webview_flutter
Supported: Yes
Required configuration: In native start: webRootDomains and supportExternalWebViews = true. There is no HUMAN Flutter package that turns the flag on for you.
Active channel: Cookies (wrapper-hosted).
Known limitations: The flag is a manual native step. Automatic interceptor is not supported in Flutter.
Fallback: Cookies → legacy only. See Channel cascade.
Ionic / Capacitor
Supported: Yes
Required configuration: In native start: webRootDomains and supportExternalWebViews = true. The flag is set manually.
Active channel: Cookies (wrapper-hosted).
Known limitations: Omitting the flag leaves hybrid cookies unset with no wrapper to compensate. Automatic interceptor is not supported in Ionic.
Fallback: Cookies → legacy only. See Channel cascade.
Cordova
Supported: Yes
Required configuration: In native start: webRootDomains and supportExternalWebViews = true. The flag is set manually.
Active channel: Cookies (wrapper-hosted).
Known limitations: Same manual-flag requirement as Capacitor. There is no HUMAN Cordova package.
Fallback: Cookies → legacy only. See Channel cascade.
Special integration
If your app uses SFSafariViewController or Chrome Custom Tabs, please contact us and we will guide you through a specific integration. Default Hybrid App setup does not apply because those containers own a cookie jar the app cannot reach with setupWebView.
SFSafariViewController
Supported: Special integration
Required configuration: Contact HUMAN. Standard setupWebView / hybrid cookies do not apply because SFSafariViewController shares Safari’s cookie jar.
Active channel: Not the standard SDK hybrid channels. Arranged as part of the specific integration.
Known limitations: The app cannot write _pxmd / _pxwvm into Safari’s jar with the default Hybrid App setup.
Fallback: Not the standard cascade. Contact HUMAN for a specific integration.
Chrome Custom Tabs
Supported: Special integration
Required configuration: Contact HUMAN. Standard setupWebView / hybrid cookies do not apply because the Custom Tab owns a cookie jar the app cannot reach.
Active channel: Not the standard SDK hybrid channels. Arranged as part of the specific integration.
Known limitations: Default Hybrid App setup cannot write into the Custom Tab cookie jar.
Fallback: Not the standard cascade. Contact HUMAN for a specific integration.