Category: How-To’s

When your website is accessed through a WebView, it’s crucial to make sure that good security practices are in place to avoid potential risks. Even with a secure WebView, weaknesses in your website could expose users to attacks. This guide outlines essential security practices website owners should follow to create a safe browsing environment in the app.

1. Use HTTPS Everywhere

Why it matters:

• HTTPS encrypts data exchanged between the client (WebView) and server, ensuring confidentiality and integrity of user data. This prevents attackers from intercepting or altering the data.

How to implement:

• Obtain an SSL certificate and configure your server to redirect all traffic from HTTP to HTTPS.
• Enforce HTTPS on all connections.

2. Implement Content Security Policy (CSP)

Why it matters:

• CSP protects against cross-site scripting (XSS) attacks by controlling which resources are allowed to load on your site. This is particularly important for WebView, where the app’s security may rely on your website’s content security.

How to implement:

Define a strict CSP header in your server configuration or HTML using the following meta tag:

"Content-Security-Policy" content="default-src 'self'; script-src 'self' https://trusted-scripts.com">

You can learn more about CSP here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Tip: Test your CSP in a staging environment to ensure no legitimate functionality is blocked.

3. Sanitize and Validate User Inputs

Why it matters:

• Input validation prevents attackers from injecting malicious scripts or SQL commands. In a WebView environment, improper validation could allow attackers to manipulate website behavior through user inputs.

How to implement:

• Validate all user inputs server-side, even if you’ve done client-side validation.
• Use libraries such as OWASP Validator to clean and sanitize inputs.
• Escape special characters to prevent XSS and SQL injection.

Tip: Never rely solely on client-side validation, as it can be bypassed easily.

4. Leverage Secure Cookies with HTTPOnly and SameSite Flags

Why it matters:

• Secure cookies protect user sessions from being hijacked, especially in WebView, where cookies may store sensitive information like login credentials.

How to implement:

Set cookies with the Secure, HttpOnly, and SameSite attributes to ensure they are only accessible over HTTPS and are restricted from being accessed by JavaScript.

You can find more details here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie

Tip: Always use SameSite=Strict for highly sensitive cookies, such as those used for authentication.

5. Avoid Inline Scripts and External Resources from Untrusted Sources

Why it matters:

• Inline scripts or resources from untrusted sources could introduce vulnerabilities or allow third-party content to run malicious code. In WebView, these scripts may exploit the in-app browser environment.

How to implement:

• Avoid using inline JavaScript in your HTML.
• Host your scripts and styles on your domain or trusted CDNs.
• Ensure third-party resources like analytics or ad scripts are from verified, secure providers.

‍

In order to enable the print functionality in your app you will need to add the following parameters to your advanced configuration:

"Printing": {
    "Enable_Printing": true,
    "Regex": ".*print.*"
  }

The “Regex” parameter determines which URLs will trigger the printing. You will need to make sure that the URLs that should trigger the print feature match the regex code used.

If your URL looks like this: https://website.com/document?print=true

You can use the value displayed in our example, it will be a match because the URL contains “print” in it.

TestFlight is an app provided by Apple to allow users to test apps before making them publicly available in the App Store.

In order to be able to invite users as testers to TestFlight you first need to make sure the user is added to your App Store Connect account. You can find a complete guide on how to invite users to your account by clicking here.

Below you can find a step-by-step guide on how to invite users to test your app using TestFlight.

1. On App Store Connect, open your list of apps then select the app to which you would like to invite your users as testers, you can use this link: https://appstoreconnect.apple.com/apps

2. On the app details page, click “TestFlight”

3. You will need to create a new Internal Testing group, you can do so by clicking on the “+” icon:

4. Type in the name of your Internal Testing group, the name will be visible to invited testers

5. With your Internal Testing group created, you can now invite users by clicking on the “+” icon

6. Select the users that you would like to add as testers to the app and click “Add”

7. That’s it! The selected users will receive an invitation in their emails, the invitation will include a “Redeem code” which can be used in TestFlight to redeem and install your app for testing purposes.

Google Tag Manager (GTM) allows you to grant access to other users so they can manage tags, triggers, and variables within a container. Follow these steps to invite users to a GTM container.

Step 1: Sign in to Google Tag Manager

1. Go to Google Tag Manager.
2. Sign in with your Google account that has administrator access.

Step 2: Open the Account and Container

Click on the Container you want to share access to.

Step 3: Open User Management Settings

1. In the Admin panel (located in the top left-hand menu), select User Management under the Container level.
2. Select Container Settings > User Management.

Step 4: Add a New User

1. Click the + (plus) button in the top-right corner.
2. Select Add users from the dropdown menu.

Step 5: Enter User Details

1. Enter the email address of the user you want to invite.
2. Choose the user’s permissions:
   • Read – Can view container settings but cannot make changes.
   • Edit – Can create and edit tags but cannot publish changes.
   • Approve – Can create, edit, and approve changes but cannot publish them.
   • Publish – Can create, edit, approve, and publish changes.
3. Check Notify new users by email to send an invitation email.

Step 6: Save and Confirm

1. Click Invite to send the user an invitation.
2. The invited user will receive an email with access to the container.

‍

Google Tag Manager (GTM) allows you to grant access to other users so they can manage tags, triggers, and variables within a container. Follow these steps to invite users to a GTM container.

Step 1: Sign in to Google Tag Manager

1. Go to Google Tag Manager.
2. Sign in with your Google account that has administrator access.

Step 2: Open the Account and Container

Click on the Container you want to share access to.

Step 3: Open User Management Settings

1. In the Admin panel (located in the top left-hand menu), select User Management under the Container level.
2. Select Container Settings > User Management.

Step 4: Add a New User

1. Click the + (plus) button in the top-right corner.
2. Select Add users from the dropdown menu.

Step 5: Enter User Details

1. Enter the email address of the user you want to invite.
2. Choose the user’s permissions:
   • Read – Can view container settings but cannot make changes.
   • Edit – Can create and edit tags but cannot publish changes.
   • Approve – Can create, edit, and approve changes but cannot publish them.
   • Publish – Can create, edit, approve, and publish changes.
3. Check Notify new users by email to send an invitation email.

Step 6: Save and Confirm

1. Click Invite to send the user an invitation.
2. The invited user will receive an email with access to the container.

‍