Reference
Security
How the SecurityPolicy keeps untrusted pages away from your Java code: navigation lock, message check and more.
The page can call everything you register with onMessage, so each window has a SecurityPolicy. The default, SecurityPolicy.standard(), trusts your own content plus origins you list, and blocks the rest.
Protections
| Protection | When on | Switch |
|---|---|---|
| Navigation lock | Links, redirects, frames and loadUrl to an untrusted origin are cancelled | withLockNavigation |
| Message check | Messages from an untrusted page never reach onMessage | withRestrictMessages |
| New windows | window.open and target=_blank are refused | withBlockNewWindows |
| Permissions | Camera, microphone, location and similar are denied | withDenyPermissions |
| Bridge in frames | window.jolt exists only in the top-level page | withBridgeInSubframes |
Configure it
WindowOptions.defaults().withSecurity(SecurityPolicy.standard().withTrustedOrigins("http://localhost:5173"));
window.setSecurity(window.security().withLockNavigation(false)); // change it any time
window.onBlocked(event -> openInSystemBrowser(event.url())); // called after something was blockedloadUrlto another site is blocked unless you trust its origin.- Trusting an origin gives that site your handlers. List only sites you control, and still validate every parameter.
- WebView2 reports which frame sent a message; WebKitGTK does not, so on Linux the check uses the top-level page. If you turn the navigation lock off on Linux, keep the bridge out of frames (the default).
- In the page, set user-supplied text with
textContent, neverinnerHTML.