Android不安全的WebViewClient.onReceivedSslError处理程序实现

Question

We are using WebView to load paytm payment pages in our app. In this process we faced Ssl certificate error. To handle this we added SslErrorHandler.proceed() in our code. Everything is working fine. I tried publishing this apk to store, but the app got rejected mentioning

unsafe implementation of WebViewClient.onReceivedSslError handler

Here is my code

    fcweb.getSettings().setJavaScriptEnabled(true);
    fcweb.getSettings().setDomStorageEnabled(true);
    fcweb.setLongClickable(false);
    fcweb.setHapticFeedbackEnabled(false);
    CookieManager.getInstance().setAcceptCookie(true);
    fcweb.setWebViewClient(new WebViewClient(){

        @Override
        public void onReceivedSslError(WebView view, SslErrorHandler handler, SslError error) {
            handler.proceed(); // Ignore SSL certificate errors
            L.d("SSL Error received");

        }

    });

Note : I dont want to show any alert dialog regarding the error. What should I do to resolve this?

Answer 1

Not Always force to handler.proceed(); but you have to also include handler.cancel(); so user can avoid unsafe content from loading.

To properly handle SSL certificate validation, change your code to invoke SslErrorHandler.proceed() whenever the certificate presented by the server meets your expectations, and invoke SslErrorHandler.cancel() otherwise.

    @Override 
public void onReceivedSslError(WebView view, final SslErrorHandler handler, SslError error) {
    final AlertDialog.Builder builder = new AlertDialog.Builder(this);
    builder.setMessage(R.string.notification_error_ssl_cert_invalid);
    builder.setPositiveButton("continue", new DialogInterface.OnClickListener() {
        @Override 
        public void onClick(DialogInterface dialog, int which) {
            handler.proceed();
        } 
    }); 
    builder.setNegativeButton("cancel", new DialogInterface.OnClickListener() {
        @Override 
        public void onClick(DialogInterface dialog, int which) {
            handler.cancel();
        } 
    }); 
    final AlertDialog dialog = builder.create();
    dialog.show();
}