interface ICoreWebView2ExperimentalCustomSchemeRegistration
Note
This reference is no longer being maintained. For the latest API reference, see WebView2 API Reference.
Note
This an experimental API that is shipped with our prerelease SDK. See WebView2 release notes.
interface ICoreWebView2ExperimentalCustomSchemeRegistration
: public IUnknown
Represents the registration of a custom scheme with the CoreWebView2Environment.
Summary
Members | Descriptions |
---|---|
get_HasAuthorityComponent | Set this property to true if the URIs with this custom scheme will have an authority component (a host for custom schemes). |
get_SchemeName | The name of the custom scheme to register. |
get_TreatAsSecure | Whether the sites with this scheme will be treated as a Secure Context like an HTTPS site. |
GetAllowedOrigins | List of origins that are allowed to issue requests with the custom scheme, such as XHRs and subresource requests that have an Origin header. |
put_HasAuthorityComponent | Get has authority component. |
put_TreatAsSecure | Set if the scheme will be treated as a Secure Context. |
SetAllowedOrigins | Set the array of origins that are allowed to use the scheme. |
This allows the WebView2 app to be able to handle WebResourceRequested event for requests with the specified scheme and be able to navigate the WebView2 to the custom scheme. Once the environment is created, the registrations are valid and immutable throughout the lifetime of the associated WebView2s' browser process and any WebView2 environments sharing the browser process must be created with identical custom scheme registrations, otherwise the environment creation will fail. Any further attempts to register the same scheme will fail during environment creation. The URIs of registered custom schemes will be treated similar to http URIs for their origins. They will have tuple origins for URIs with host and opaque origins for URIs without host as specified in 7.5 Origin - HTML Living Standard
Example: custom-scheme-with-host://hostname/path/to/resource
has origin of custom-scheme-with-host://hostname
. custom-scheme-without-host:path/to/resource
has origin of custom-scheme-without-host:path/to/resource
. For WebResourceRequested event, the cases of request URIs and filter URIs with custom schemes will be normalized according to generic URI syntax rules. Any non-ASCII characters will be preserved. The registered custom schemes also participate in CORS and adheres to CSP. The app needs to set the appropriate access headers in its WebResourceRequested event handler to allow CORS requests.
Microsoft::WRL::ComPtr<ICoreWebView2ExperimentalEnvironmentOptions> optionsExperimental;
if (options.As(&optionsExperimental) == S_OK)
{
const WCHAR* allowedOrigins[1] = {L"https://*.example.com"};
auto customSchemeRegistration =
Microsoft::WRL::Make<CoreWebView2CustomSchemeRegistration>(L"custom-scheme");
customSchemeRegistration->SetAllowedOrigins(1, allowedOrigins);
auto customSchemeRegistration2 =
Microsoft::WRL::Make<CoreWebView2CustomSchemeRegistration>(L"wv2rocks");
customSchemeRegistration2->put_TreatAsSecure(TRUE);
customSchemeRegistration2->SetAllowedOrigins(1, allowedOrigins);
customSchemeRegistration2->put_HasAuthorityComponent(TRUE);
auto customSchemeRegistration3 =
Microsoft::WRL::Make<CoreWebView2CustomSchemeRegistration>(
L"custom-scheme-not-in-allowed-origins");
ICoreWebView2ExperimentalCustomSchemeRegistration* registrations[3] = {
customSchemeRegistration.Get(), customSchemeRegistration2.Get(),
customSchemeRegistration3.Get()};
optionsExperimental->SetCustomSchemeRegistrations(
2, static_cast<ICoreWebView2ExperimentalCustomSchemeRegistration**>(registrations));
}
Applies to
Product | Introduced |
---|---|
WebView2 Win32 | N/A |
WebView2 Win32 Prerelease | 1.0.1340 |
Members
get_HasAuthorityComponent
Set this property to true
if the URIs with this custom scheme will have an authority component (a host for custom schemes).
public HRESULT get_HasAuthorityComponent(BOOL * hasAuthorityComponent)
Specifically, if you have a URI of the following form you should set the HasAuthorityComponent
value as listed.
URI | Recommended HasAuthorityComponent value |
---|---|
custom-scheme-with-authority://host/path |
true |
custom-scheme-without-authority:path |
false |
When this property is set to true
, the URIs with this scheme will be interpreted as having a scheme and host origin similar to an http URI. Note that the port and user information are never included in the computation of origins for custom schemes. If this property is set to false
, URIs with this scheme will have an opaque origin similar to a data URI. This property is false
by default.
Note: For custom schemes registered as having authority component, navigations to URIs without authority of such custom schemes will fail. However, if the content inside WebView2 references a subresource with a URI that does not have an authority component, but of a custom scheme that is registered as having authority component, the URI will be interpreted as a relative path as specified in RFC3986. For example, custom-scheme-with-authority:path
will be interpreted as custom-scheme-with-authority://host/path
. However, this behavior cannot be guaranteed to remain in future releases so it is recommended not to rely on this behavior.
get_SchemeName
The name of the custom scheme to register.
public HRESULT get_SchemeName(LPWSTR * schemeName)
get_TreatAsSecure
Whether the sites with this scheme will be treated as a Secure Context like an HTTPS site.
public HRESULT get_TreatAsSecure(BOOL * treatAsSecure)
false
by default.
GetAllowedOrigins
List of origins that are allowed to issue requests with the custom scheme, such as XHRs and subresource requests that have an Origin header.
public HRESULT GetAllowedOrigins(UINT32 * allowedOriginsCount, LPWSTR ** allowedOrigins)
The origin of any request (requests that have the Origin header) to the custom scheme URI needs to be in this list. No-origin requests are requests that do not have an Origin header, such as link navigations, embedded images and are always allowed. Note that cross-origin restrictions still apply. From any opaque origin (Origin header is null), no cross-origin requests are allowed. If the list is empty, no cross-origin request to this scheme is allowed. Origins are specified as a string in the format of scheme://host:port. The origins are string pattern matched with *
(matches 0 or more characters) and ?
(matches 0 or 1 character) wildcards just like the URI matching in the AddWebResourceRequestedFilter API. For example, "http://*.example.com:80". Here's a set of examples of what is allowed and not:
Request URI |Originating URL |AllowedOrigins |Allowed
--------- | --------- | --------- | ---------
custom-scheme:request
|https://www.example.com
|{"https://www.example.com"} |Yes
custom-scheme:request
|https://www.example.com
|{"https://.example.com"} |Yes
custom-scheme:request
|https://www.example.com
|{"https://www.example2.com"} |No
custom-scheme-with-authority://host/path
|custom-scheme-with-authority://host2
|{""} |No
custom-scheme-with-authority://host/path
|custom-scheme-with-authority2://host
|{"custom-scheme-with-authority2://"} |Yes
custom-scheme-without-authority:path
|custom-scheme-without-authority:path2 |{"custom-scheme-without-authority:"} |No
custom-scheme-without-authority:path
|custom-scheme-without-authority:path2 |{""} |Yes
The returned strings and the array itself must be deallocated with CoTaskMemFree.
put_HasAuthorityComponent
Get has authority component.
public HRESULT put_HasAuthorityComponent(BOOL hasAuthorityComponent)
put_TreatAsSecure
Set if the scheme will be treated as a Secure Context.
public HRESULT put_TreatAsSecure(BOOL value)
SetAllowedOrigins
Set the array of origins that are allowed to use the scheme.
public HRESULT SetAllowedOrigins(UINT32 allowedOriginsCount, LPCWSTR * allowedOrigins)