Cordova: Whitelist rejection error

Written by Sepp Wijnands on Tuesday 12 November 2013 in mobile

In older versions of Phonegap and Cordova the default setting was to disallow applications to access any external network host, unless explicitly specified in the config file.

If you are unfamiliar with this functionality, the first time you try to access an external resource, you will be greeted by the following error message in some form or another:

2013-11-12 18:06:04.847 HelloCordova[14941:70b] ERROR whitelist rejection: url='http://www.facebook.com/'

Upgrading to a newer version of Cordova/Phonegap will not automatically fix this problem for you, because the policy is controlled by the www/config.xml file, which will be generated only once, and then be left alone by the command line utilities.

Cordova 2.2.0 and below

iOS

The whitelist settings are controlled by the Cordova.plist settings file, you can find this file in the iOS application directory.

Look for the following lines:

<key>ExternalHosts</key>
<array/>

To allow access to any external network host, replace the above two lines with the following:

<key>ExternalHosts</key>
<array>
    <string>*</string>
</array>
Android

The whitelist settings are found in the res/xml/config.xml file.

Look for the following line:

<access origin="..." />

To allow access to any external network host, replace the above line with the following:

<access origin="*" />

Cordova 2.3.0

From 2.3.0 and upwards the iOS platform also uses a xml config file, aptly named: config.xml. And works more or less the same as for Android.

iOS & Android

Look for the following line:

<access origin="..." />

To allow access to any external network host, replace the above line with the following:

<access origin="*" />

Cordova 2.4.0 and up

From Cordova 2.4.0 and upwards the default policy is to allow access to any external network host, no changes are necessary unless you upgraded from an older version. You can follow the steps outlined above for the appropiate version you upgraded from.

Documentation

More detailed documentation about whitelisting only certain domains, in the lastest version of Cordova can be found in this excellent in depth guide.

comments powered by Disqus

Since 2006 our products and services have helped hundreds of people optimize their daily business: