Intercept POST requests in a WebView

Question

I'm developping an Android application filtering the requests (with a white list) and using a custom SSLSocketFactory. For this, I've developed a custom WebViewClient and I have overridden the shouldInterceptRequest method. I can filter and use my SocketFactory with the GET requests but I can't intercept the POST requests.

So, is there a way to intercept the POST requests in a WebView ?

Here is the code of the shouldInterceptRequest method :

public final WebResourceResponse shouldInterceptRequest(WebView view, String urlStr) {     URI uri = URI.create(urlStr);     String scheme = uri.getScheme();     // If scheme not http(s), let the default webview manage it     if(!"http".equals(scheme) && !"https".equals(scheme)) {         return null;     }     URL url = uri.toURL();      if(doCancelRequest(url)) {         // Empty response         Log.d(TAG, "URL filtered: " + url);         return new WebResourceResponse("text/plain", "UTF-8", new EmptyInputStream());      } else {         Log.d(TAG, "URL: " + url);          HttpURLConnection conn = (HttpURLConnection) url.openConnection();         conn.setRequestProperty("User-Agent", mSettings.getUserAgentString());          // Configure connections         configureConnection(conn);          String mimeType = conn.getContentType();         String encoding = conn.getContentEncoding();          if(mimeType != null && mimeType.contains(CONTENT_TYPE_SPLIT)) {             String[] split = mimeType.split(CONTENT_TYPE_SPLIT);             mimeType = split[0];              Matcher matcher = CONTENT_TYPE_PATTERN.matcher(split[1]);             if(matcher.find()) {                 encoding = matcher.group(1);             }         }          InputStream is = conn.getInputStream();         return new WebResourceResponse(mimeType, encoding, is);     } } 

Answer 1

I was facing the same issue a few days ago.

So I built a library that solves it:

https://github.com/KonstantinSchubert/request_data_webviewclient

It is a WebViewClient with a custom WebResourceRequest that contains the POST/PUT/... payload of XMLHttpRequest requests.

It only works for these though - not for forms and other kind of request sources.

The hack works, basically, by injecting a script into the HTML that intercepts XMLHttpRequest calls. It records the post/put/... content and sends it to an android.webkit.JavascriptInterface. There, the request is stashed until the shouldInterceptRequest method is called by Android ...