Cordova/Phonegap API running inside the InAppBrowser with remote content

545 views
Skip to first unread message

james

unread,
Nov 9, 2016, 9:14:27 AM11/9/16
to phonegap
I am working on an app that pulls content from a website, but I need the device API functionality such as barcode scan etc.

I have done this before but not for a few years. I am using the InAppBrowser which works great at pulling in the website content, but I cannot find a working example of how to call the native APIs from inside the InAppBrowser.


Here is a link (from the page linked above), showing some backend server-side code: http://pastebin.com/7MJh9uas

I cannot get it to work. Does anyone have a working example please? I don't mind if it is iOS, Android etc.

Thank you!

Simon MacDonald

unread,
Nov 9, 2016, 9:23:01 AM11/9/16
to phonegap
By definition the inappbrowser does not give you access to Cordova
API's. See the docs:

The InAppBrowser window behaves like a standard web browser, and can't
access Cordova APIs. For this reason, the InAppBrowser is recommended
if you need to load third-party (untrusted) content, instead of
loading that into the main Cordova webview. The InAppBrowser is not
subject to the whitelist, nor is opening links in the system browser.

https://cordova.apache.org/docs/en/latest/reference/cordova-plugin-inappbrowser/

So if you trust the remote content you'll just have to load it
directly into your app.


Simon Mac Donald
http://simonmacdonald.com
> --
> -- You received this message because you are subscribed to the Google
> Groups "phonegap" group.
> To post to this group, send email to phon...@googlegroups.com
> To unsubscribe from this group, send email to
> phonegap+u...@googlegroups.com
> For more options, visit this group at
> http://groups.google.com/group/phonegap?hl=en?hl=en
>
> For more info on PhoneGap or to download the code go to www.phonegap.com
> ---
> You received this message because you are subscribed to the Google Groups
> "phonegap" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to phonegap+u...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

James Henderson

unread,
Nov 9, 2016, 9:44:13 AM11/9/16
to phon...@googlegroups.com
Hi Simon, great to hear from you again after all these years!

The links I included explain how to achieve this - I just need a working example of how to do this with a more recent cordova version please.

I think it was you who explained it to me before (about 5 years ago I think).

All the best, James




> For more options, visit this group at
> http://groups.google.com/group/phonegap?hl=en?hl=en
>
> For more info on PhoneGap or to download the code go to www.phonegap.com
> ---
> You received this message because you are subscribed to the Google Groups
> "phonegap" group.
> To unsubscribe from this group and stop receiving emails from it, send an

> For more options, visit https://groups.google.com/d/optout.

--
-- You received this message because you are subscribed to the Google
Groups "phonegap" group.
To post to this group, send email to phon...@googlegroups.com
To unsubscribe from this group, send email to

For more options, visit this group at
http://groups.google.com/group/phonegap?hl=en?hl=en

For more info on PhoneGap or to download the code go to www.phonegap.com
---
You received this message because you are subscribed to the Google Groups "phonegap" group.
To unsubscribe from this group and stop receiving emails from it, send an email to phonegap+unsubscribe@googlegroups.com.

James Henderson

unread,
Nov 9, 2016, 10:39:46 AM11/9/16
to phon...@googlegroups.com
Can you recommend a good way to pull the contents of a website into Phonegap/Cordova app please? I have tried a few different techniques, such as jQuery load, iframes etc, but I cannot easily change the website code, it has old-fashioned forms and hyperlinks, and everything is relative urls. The InAppBrowser is excellent as the site works as it would do in a normal browser, but the device API functionality is a problem. Thank you in advance for any tips!

Steve Husting

unread,
Nov 9, 2016, 10:58:25 AM11/9/16
to phonegap
Did you see this part of Simon's answer? "By definition the inappbrowser does not give you access to Cordova
API's." Let us know if we misunderstand.

> For more options, visit this group at
> http://groups.google.com/group/phonegap?hl=en?hl=en
>
> For more info on PhoneGap or to download the code go to www.phonegap.com
> ---
> You received this message because you are subscribed to the Google Groups
> "phonegap" group.
> To unsubscribe from this group and stop receiving emails from it, send an

> For more options, visit https://groups.google.com/d/optout.

--
-- You received this message because you are subscribed to the Google
Groups "phonegap" group.
To post to this group, send email to phon...@googlegroups.com
To unsubscribe from this group, send email to

For more options, visit this group at
http://groups.google.com/group/phonegap?hl=en?hl=en

For more info on PhoneGap or to download the code go to www.phonegap.com
---
You received this message because you are subscribed to the Google Groups "phonegap" group.
To unsubscribe from this group and stop receiving emails from it, send an email to phonegap+u...@googlegroups.com.

James Henderson

unread,
Nov 9, 2016, 11:01:13 AM11/9/16
to phon...@googlegroups.com
Would you mind having a look at this page please? I think it will help you understand what I need to achieve. As mentioned, I have done it before.


Here is a link (from the page linked above), showing some backend server-side code: http://pastebin.com/7MJh9uas

Thank you so much for your time, James

--
-- You received this message because you are subscribed to the Google
Groups "phonegap" group.
To post to this group, send email to phon...@googlegroups.com
To unsubscribe from this group, send email to
phonegap+unsubscribe@googlegroups.com

For more options, visit this group at
http://groups.google.com/group/phonegap?hl=en?hl=en
 
For more info on PhoneGap or to download the code go to www.phonegap.com
---
You received this message because you are subscribed to the Google Groups "phonegap" group.
To unsubscribe from this group and stop receiving emails from it, send an email to phonegap+unsubscribe@googlegroups.com.

jcesarmobile

unread,
Nov 10, 2016, 5:59:45 AM11/10/16
to phonegap
Where in that link it says that you have to use InAppBrowser?
It doesn't
You can't use InAppBrowser because it doesn't give you access  to Cordova

We understand what you are trying to achieve, but you are not understanding that you can't use InAppBrowser for that.

Read again your link, what he is doing is making InAppBrowser plugin work from a remote website, not loading the remote website inside InAppBrowser, he includes inappbrowse.js to make InAppBrowser plugin work, you have to include any .js from the plugins you want to make work.


El miércoles, 9 de noviembre de 2016, 17:01:13 (UTC+1), james escribió:
Would you mind having a look at this page please? I think it will help you understand what I need to achieve. As mentioned, I have done it before.


Here is a link (from the page linked above), showing some backend server-side code: http://pastebin.com/7MJh9uas

Thank you so much for your time, James
On 9 November 2016 at 14:14, james <jameshend...@gmail.com> wrote:
I am working on an app that pulls content from a website, but I need the device API functionality such as barcode scan etc.

I have done this before but not for a few years. I am using the InAppBrowser which works great at pulling in the website content, but I cannot find a working example of how to call the native APIs from inside the InAppBrowser.


Here is a link (from the page linked above), showing some backend server-side code: http://pastebin.com/7MJh9uas

I cannot get it to work. Does anyone have a working example please? I don't mind if it is iOS, Android etc.

Thank you!

--
-- You received this message because you are subscribed to the Google
Groups "phonegap" group.
To post to this group, send email to phon...@googlegroups.com
To unsubscribe from this group, send email to

For more options, visit this group at
http://groups.google.com/group/phonegap?hl=en?hl=en
 
For more info on PhoneGap or to download the code go to www.phonegap.com
---
You received this message because you are subscribed to the Google Groups "phonegap" group.
To unsubscribe from this group and stop receiving emails from it, send an email to phonegap+u...@googlegroups.com.

James Henderson

unread,
Nov 10, 2016, 10:13:31 AM11/10/16
to phon...@googlegroups.com
Thanks guys - I have the answer now.

There are two things I was hoping to achieve, (1) to view a large old-fashioned/non-asynchronous web application (which I cannot change) with a browser like experience, which needs some device API functionality to, but also (2) I was hoping to be able to host the cordova and other js files remotely so that they can all be updated without the need for going to the app stores.

Its a long story, I am sure you know lots of people who will say that Apple will not approve it, but all I am doing is simply converting some existing ObjectiveC apps that have been on Apple's store for years, which have this same functionality. The Whitelist enforces only trusted content so I don't see any security problems at this stage, but please say something if you don't agree.

Mainly I work with enterprise platforms that have remote app install/uninstall etc, and this is also an option here, so Apple approval is not an issue.

I'm just annoyed I can't find my old code :)




For more options, visit this group at
http://groups.google.com/group/phonegap?hl=en?hl=en
 
For more info on PhoneGap or to download the code go to www.phonegap.com
---
You received this message because you are subscribed to the Google Groups "phonegap" group.
To unsubscribe from this group and stop receiving emails from it, send an email to phonegap+unsubscribe@googlegroups.com.

Kerri Shotts

unread,
Nov 10, 2016, 12:49:02 PM11/10/16
to phonegap
 (1) to view a large old-fashioned/non-asynchronous web application (which I cannot change) with a browser like experience, which needs some device API functionality to

I think it's critical to understand that, although Cordova uses a web view, Cordova is not intended to act as a browser. There's lots of edge cases there where a normal browser supplies a user interface (like file management) but Cordova may or does not. I think there be dragons, so just be aware that what you expect to work in an actual browser may not in this context.

 (2) I was hoping to be able to host the cordova and other js files remotely so that they can all be updated without the need for going to the app stores.

Two things:
  • Last I knew, cordova.js was platform-specific. So you'd have to write some local code to load the appropriate file depending on which device was being used. Plugins also get injected with another file `cordova-plugins.js`. I don't know if that one is platform-specific or not.
    • You'd also have to ensure that the server version matched the version of the app that your users had installed. That could get painful if you have users that don't immediately update to the latest version.
  • Code push is a thing now. Microsoft has theirs, PGB has Hydration, etc. Apple doesn't mind you making changes to your app outside the app store anymore as long as those changes don't fundamentally change the nature of your app. (For example, change your note-taking app in to a Minecraft clone. Or inject malicious malware.)
The Whitelist enforces only trusted content so I don't see any security problems at this stage, but please say something if you don't agree.

No, no, no, no, no, no, no, no! The whitelist only enforces what you can connect/navigate to. It does not ensure that the endpoint is in any way secure or returning the data that your app expects.

If you want to increase the security here:
  • Use HTTPS
  • Have local code check the certificate being served by the remote site BEFORE navigating to it. This does not necessarily prevent MITM attacks as it can be worked around, but it will at least make things a little more difficult.
  • Make sure to follow OWASP's security best practices!
Even with that, I highly caution against allowing any remote code access to the user's device, because that remote code could always be compromised somehow. This would grant the attacker access to all the plugins your app has installed. Not good.

Hope that helps.

James Henderson

unread,
Nov 11, 2016, 11:57:03 AM11/11/16
to phon...@googlegroups.com
Some useful tips - thank you for your time, I had not considered the MITM.

You are right, the cordova.js file is different for each platform, the (pastebin) link in my original message shows this using PHP.

We are using a slightly modified inAppBrowser plugin that has the device APIs - I love it because you can do a lot of the real device API development by simply reloading webview and not rebuilding the app each time.

Have a good weekend!

--

Luzi .M

unread,
Aug 14, 2017, 11:29:02 AM8/14/17
to phonegap

Could you share your way to solve this ?  I have the same problem.  I want to load a  remote url in cordova, but the  remote  url could not access to the device api.

If remote url could access device api,  things will become quite easy. 

For more options, visit this group at
http://groups.google.com/group/phonegap?hl=en?hl=en
 
For more info on PhoneGap or to download the code go to www.phonegap.com
---
You received this message because you are subscribed to the Google Groups "phonegap" group.
To unsubscribe from this group and stop receiving emails from it, send an email to phonegap+u...@googlegroups.com.

Orfeo

unread,
Nov 22, 2017, 10:08:38 AM11/22/17
to phonegap
@James, can you share the modifications in the inAppBrowser for android?

Kind regards,
Orfeo

Op vrijdag 11 november 2016 17:57:03 UTC+1 schreef james:

For more options, visit this group at
http://groups.google.com/group/phonegap?hl=en?hl=en
 
For more info on PhoneGap or to download the code go to www.phonegap.com
---
You received this message because you are subscribed to the Google Groups "phonegap" group.
To unsubscribe from this group and stop receiving emails from it, send an email to phonegap+u...@googlegroups.com.
Reply all
Reply to author
Forward
0 new messages