> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# WebView container support

A Hybrid App uses the native Mobile SDK together with an in-app WebView that loads a HUMAN-protected site. Native requests and WebView traffic must share the same VID.

This page lists which WebView containers setup supports. Use this instead of per-team guidance. For how to enable hybrid support, see [Hybrid App integration](/applications/hybrid-app-integration-v5).

## Channel cascade

The SDK can move mobile data into the WebView on more than one channel. Two independent constraints cut the cascade down:

* The events and session-storage rungs need the SDK to hold a WebView **instance**. A wrapper-hosted WebView cannot provide that.
* Android **does not have an events channel** because it does not exist.

Only iOS 14+ native gets the full cascade. Reasserting cookies on navigation or foreground can recover a jar the host app cleared. This is recovery, not fallback. It does not survive a channel that is permanently cookie-hostile.

<table>
  <thead>
    <tr>
      <th>
        Rung
      </th>

      <th>
        iOS 14+ native
      </th>

      <th>
        Android native
      </th>

      <th>
        Wrapper-hosted
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        Events
      </td>

      <td>
        Available, preferred
      </td>

      <td>
        Does not exist
      </td>

      <td>
        Unavailable — needs an instance
      </td>
    </tr>

    <tr>
      <td>
        Session storage
      </td>

      <td>
        Available
      </td>

      <td>
        Available
      </td>

      <td>
        Unavailable — needs an instance
      </td>
    </tr>

    <tr>
      <td>
        Cookies
      </td>

      <td>
        Available
      </td>

      <td>
        Available
      </td>

      <td>
        Available, and the only option
      </td>
    </tr>

    <tr>
      <td>
        Legacy scheme 1
      </td>

      <td>
        Available
      </td>

      <td>
        Available
      </td>

      <td>
        Available, same cookie dependency
      </td>
    </tr>
  </tbody>
</table>

Root-scoped `_pxmd` and `_pxwvm` are readable from page JavaScript on WebKit and Chromium across cookies, session storage, and events (where the platform has that channel).

## Support matrix

<table>
  <thead>
    <tr>
      <th>
        Container
      </th>

      <th>
        Supported
      </th>

      <th>
        Channel class
      </th>

      <th>
        Config
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        WKWebView
      </td>

      <td>
        Yes
      </td>

      <td>
        Native iOS
      </td>

      <td>
        `webRootDomains`

         \+ 

        `setupWebView`

         or 

        `automaticSetup`
      </td>
    </tr>

    <tr>
      <td>
        Android WebView
      </td>

      <td>
        Yes
      </td>

      <td>
        Native Android
      </td>

      <td>
        `webRootDomains`

         \+ 

        `setupWebView`
      </td>
    </tr>

    <tr>
      <td>
        react-native-webview
      </td>

      <td>
        Yes
      </td>

      <td>
        Wrapper-hosted
      </td>

      <td>
        `webRootDomains`

         (wrapper sets the flag)
      </td>
    </tr>

    <tr>
      <td>
        Expo WebView
      </td>

      <td>
        Yes
      </td>

      <td>
        Wrapper-hosted
      </td>

      <td>
        `webRootDomains`

         (module sets the flag)
      </td>
    </tr>

    <tr>
      <td>
        Flutter webview\_flutter
      </td>

      <td>
        Yes
      </td>

      <td>
        Wrapper-hosted
      </td>

      <td>
        `webRootDomains`

         \+ set the flag in native start
      </td>
    </tr>

    <tr>
      <td>
        Ionic / Capacitor
      </td>

      <td>
        Yes
      </td>

      <td>
        Wrapper-hosted
      </td>

      <td>
        `webRootDomains`

         \+ set the flag in native start
      </td>
    </tr>

    <tr>
      <td>
        Cordova
      </td>

      <td>
        Yes
      </td>

      <td>
        Wrapper-hosted
      </td>

      <td>
        `webRootDomains`

         \+ set the flag in native start
      </td>
    </tr>

    <tr>
      <td>
        SFSafariViewController
      </td>

      <td>
        Special
      </td>

      <td>
        Contact HUMAN
      </td>

      <td>
        Default hybrid setup does not apply
      </td>
    </tr>

    <tr>
      <td>
        Chrome Custom Tabs
      </td>

      <td>
        Special
      </td>

      <td>
        Contact HUMAN
      </td>

      <td>
        Default hybrid setup does not apply
      </td>
    </tr>
  </tbody>
</table>

Expand a container for required configuration, active channel, limitations, and fallback.

### Native

#### WKWebView

**Supported:** Yes

**Required configuration:** `hybridAppPolicy.webRootDomains` plus `HumanSecurity.setupWebView`, or iOS `hybridAppPolicy.automaticSetup = true`. Native `supportExternalWebViews` stays `false`.

**Active channel:** Events on iOS 14+ (preferred). On iOS 13, session storage then cookies.

**Known limitations:** Do not replace the SDK navigation delegate after `setupWebView`. Apple Pay on the Web may require `allowJavaScriptEvaluation = false`.

**Fallback:** iOS 14+: events → session storage → cookies → legacy. iOS 13: session storage → cookies → legacy (no events). See [Channel cascade](#channel-cascade).

#### Android WebView

**Supported:** Yes

**Required configuration:** `hybridAppPolicy.webRootDomains` plus `HumanSecurity.setupWebView`. Native `supportExternalWebViews` stays `false`.

**Active channel:** Session storage, then cookies.

**Known limitations:** Events does not exist on Android. Do not replace the SDK `WebViewClient` after `setupWebView`.

**Fallback:** Session storage → cookies → legacy. Events does not exist. See [Channel cascade](#channel-cascade).

### Wrappers — flag on by default

These containers are wrapper-hosted, which means cookies are the only option followed by legacy (same cookie dependency). Events and session storage are unavailable and need a WebView instance. Android events does not exist.

#### react-native-webview

**Supported:** Yes

**Required configuration:** Set `hybridAppPolicy.webRootDomains` when starting the HUMAN React Native wrapper. The wrapper sets `supportExternalWebViews = true` for you.

**Active channel:** Cookies (wrapper-hosted).

**Known limitations:** The SDK has no WebView instance. Automatic interceptor is not supported in React Native.

**Fallback:** Cookies → legacy only. See [Channel cascade](#channel-cascade).

#### Expo WebView

**Supported:** Yes

**Required configuration:** Set `hybridAppPolicy.webRootDomains` when starting the HUMAN Expo module. The module sets `supportExternalWebViews = true` for you.

**Active channel:** Cookies (wrapper-hosted).

**Known limitations:** Same instance constraint as other wrappers. Automatic interceptor is not supported in Expo.

**Fallback:** Cookies → legacy only. See [Channel cascade](#channel-cascade).

### Wrappers — set the flag yourself

Same wrapper-hosted cascade as above (cookies → legacy only). There is no wrapper-level default. Instead, set `supportExternalWebViews = true` in native start with `webRootDomains`.

#### Flutter webview\_flutter

**Supported:** Yes

**Required configuration:** In native start: `webRootDomains` and `supportExternalWebViews = true`. There is no HUMAN Flutter package that turns the flag on for you.

**Active channel:** Cookies (wrapper-hosted).

**Known limitations:** The flag is a manual native step. Automatic interceptor is not supported in Flutter.

**Fallback:** Cookies → legacy only. See [Channel cascade](#channel-cascade).

#### Ionic / Capacitor

**Supported:** Yes

**Required configuration:** In native start: `webRootDomains` and `supportExternalWebViews = true`. The flag is set manually.

**Active channel:** Cookies (wrapper-hosted).

**Known limitations:** Omitting the flag leaves hybrid cookies unset with no wrapper to compensate. Automatic interceptor is not supported in Ionic.

**Fallback:** Cookies → legacy only. See [Channel cascade](#channel-cascade).

#### Cordova

**Supported:** Yes

**Required configuration:** In native start: `webRootDomains` and `supportExternalWebViews = true`. The flag is set manually.

**Active channel:** Cookies (wrapper-hosted).

**Known limitations:** Same manual-flag requirement as Capacitor. There is no HUMAN Cordova package.

**Fallback:** Cookies → legacy only. See [Channel cascade](#channel-cascade).

### Special integration

If your app uses [`SFSafariViewController`](https://developer.apple.com/documentation/safariservices/sfsafariviewcontroller) or [Chrome Custom Tabs](https://developer.chrome.com/docs/android/custom-tabs), please [contact us](/applications/human-customer-support) and we will guide you through a specific integration. Default Hybrid App setup does not apply because those containers own a cookie jar the app cannot reach with `setupWebView`.

#### SFSafariViewController

**Supported:** Special integration

**Required configuration:** Contact HUMAN. Standard `setupWebView` / hybrid cookies do not apply because `SFSafariViewController` shares Safari’s cookie jar.

**Active channel:** Not the standard SDK hybrid channels. Arranged as part of the specific integration.

**Known limitations:** The app cannot write `_pxmd` / `_pxwvm` into Safari’s jar with the default Hybrid App setup.

**Fallback:** Not the standard cascade. Contact HUMAN for a specific integration.

#### Chrome Custom Tabs

**Supported:** Special integration

**Required configuration:** Contact HUMAN. Standard `setupWebView` / hybrid cookies do not apply because the Custom Tab owns a cookie jar the app cannot reach.

**Active channel:** Not the standard SDK hybrid channels. Arranged as part of the specific integration.

**Known limitations:** Default Hybrid App setup cannot write into the Custom Tab cookie jar.

**Fallback:** Not the standard cascade. Contact HUMAN for a specific integration.

## Related platform guides

* [React Native Integration (Recommended)](/applications/react-native-integration-recommended-v5)
* [Expo Integration](/applications/expo-integration-v5)
* [Flutter Integration](/applications/flutter-integration-v5)
* [Ionic Integration](/applications/ionic-integration-v5)