Android WebView 不加载混合内容

Question

我正在尝试用WebView制作一个应用程序，但是网站使用的是https，但是内容(例如mp3文件)使用的是http，所以Android Lollipop不会加载它，因为它是“混合内容”。我尝试使用 onReceivedSslError handler.proceed();，但它没有加载任何内容。有没有办法解决它？或者我可以让所有加载的网站都使用 http，所以它不会显示任何错误？

Answer 1

Since Pie (API 29), all non-HTTPS traffic in app is now disabled by default .

如果您的目标是 API 级别 26 或更高级别，您必须首先在 list 文件中启用它。添加

android:usesCleartextTraffic="true"

进入 <application>标记。

---

Since Lollipop (API 21), WebView blocks all mixed content by default .

要更改此行为，当您针对 API 级别 21 或更高级别时，请使用:

webView.getSettings().setMixedContentMode(WebSettings.MIXED_CONTENT_COMPATIBILITY_MODE);

In this mode, the WebView will attempt to be compatible with the approach of a modern web browser with regard to mixed content. Some insecure content may be allowed to be loaded by a secure origin and other types of content will be blocked. The types of content are allowed or blocked may change release to release and are not explicitly defined.

实际上，这应该允许加载图像、视频、音乐等 - 所有在被恶意第三方篡改/替换时极有可能成为重大安全威胁的内容。

---

或者使用(强烈反对):

webView.getSettings().setMixedContentMode(WebSettings.MIXED_CONTENT_ALWAYS_ALLOW);

In this mode, the WebView will allow a secure origin to load content from any other origin, even if that origin is insecure. This is the least secure mode of operation for the WebView, and where possible apps should not set this mode.