Certificate Pinning in Android Webview

Question

I am creating a small demo app to implement ssl certificate pinning in android webview. I have generated the certificates of the host. Can anyone suggest me how to pin the certificates in the application code. I have searched many links but I am still stuck.

Answer 1

WebViews are tricky, not least because there is no perfect way to implement pinning in them except with Android N using Network Security Configuration .

The best you can do is override shouldInterceptRequest and implement the network calls yourself using one of the methods described in Android Security: SSL Pinning , however this only intercepts GET requests so if your WebViews use POST requests then you are out of luck. Android-SSL-Pinning-WebViews shows an example of doing this.