You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
target | *Optional* <br/> {% cdv_platform electron %} <br/> Set target to supply unique icons for `app` and `installer`
47
47
48
-
The following configuration can be used to define a single default icon
49
-
which will be used for all platforms.
50
-
```xml
51
-
<iconsrc="res/icon.png" />
52
-
```
53
-
For each platform, you can also define a pixel-perfect icon set to fit
54
-
different screen resolutions.
55
-
56
48
## Android
57
49
58
-
Instead of using a single image for an icon, you can use two images (background and foreground) to create an **Adaptive Icon**. To use Adaptive Icons in Cordova, at minimum**Cordova CLI** 9.0.0 and **Cordova-Android** 8.0.0 is required.
50
+
Android's **Adaptive Icons** feature enables you to create separate foreground and background layers for your App Icons. To use Adaptive Icons in Cordova, you need at least**Cordova CLI** 9.0.0 and **Cordova-Android** 8.0.0.
59
51
60
-
Android 13 has introduced themed icons which are monochrome images appended to the existing **Adaptive Icons**. To use Themed Icon in Cordova, at minimum**Cordova CLI** 12.0.0 and **Cordova-Android** 12.0.0 is required.
52
+
With Android 13, Google introduced **Themed Icons**, which are monochrome variations of **Adaptive Icons** that integrate seamlessly with the system's color scheme. To use **Themed Icons** in Cordova, you'll need at least**Cordova CLI** 12.0.0 and **Cordova-Android** 12.0.0.
@@ -71,6 +63,7 @@ density | *Required* <br/> Specified icon density
71
63
To use the adaptive icons the `background`, `foreground` and optionally `monochrome` attributes must be defined in place of the `src` attribute. The `src` attribute is not used for adaptive icons.
@@ -85,6 +78,7 @@ To use the adaptive icons the `background`, `foreground` and optionally `monochr
85
78
**Note:** In this example, the foreground image will also be used as the fallback icon for Android devices that do not support the adaptive icons. The fallback icon can be overridden by setting the src attribute.
android-buildToolsVersion<br/>{% cdv_vartype semver %} {% cdv_platform android %} | *Default: [Dependent on cordova-android Version][android-api-level-support]* <br/> Expects a full version string eg. "32.0.0". Changing this may also requires changing the PATH environment variable to find the proper build tools.<br/><br/>This preference is primarily for cordova development, for testing upcoming versions of the Android SDK. Changing this has a high risk of breaking builds as newer build tools frequently introduce breaking changes.
326
326
GradleVersion<br/>{% cdv_vartype string %} {% cdv_platform android %} | *Default: [Dependent on cordova-android Version][android-api-level-support]* <br/> Sets the gradle wrapper version to use.<br/> <br/>This preference is primarily for cordova development, for testing upcoming versions of the Android SDK. Changing this has a high risk of breaking builds as newer build tools frequently introduce breaking changes.
327
327
AndroidGradlePluginVersion<br/>{% cdv_vartype semver %} {% cdv_platform android %} | *Default: [Dependent on cordova-android Version][android-api-level-support]* <br/> Sets the Android Gradle Plugin version to use.<br/> <br/>This preference is primarily for cordova development, for testing upcoming versions of the Android SDK. Changing this has a high risk of breaking builds as newer build tools frequently introduce breaking changes.
328
+
AndroidShowDeprecations<br />{% cdv_vartype boolean %} {% cdv_platform android %} | *Default: false* <br />Prints deprecation warnings for the android platform in the build output.<br /><br />This preference is primarily intended for cordova core and plugin development.
AppendUserAgent<br/>{% cdv_vartype string %} {% cdv_platform android %} {% cdv_platform ios %} | If set, the value will append to the end of old UserAgent of webview. When using with OverrideUserAgent, this value will be ignored.
331
332
AutoHideSplashScreen<br/> {% cdv_vartype boolean %} {% cdv_platform android %} {% cdv_platform ios %} | *Default: true* <br/> Indicates whether to hide splash screen automatically or not. The splash screen is hidden after the amount of time specified in the `SplashScreenDelay` preference.
332
333
BackgroundColor<br/>{% cdv_vartype string %} {% cdv_platform android %} {% cdv_platform ios %} | Sets the app's background color. Supports a four-byte hex value, with the first byte representing the alpha channel, and standard RGB values for the following three bytes.
333
334
CordovaWebViewEngine<br/>{% cdv_vartype string %} {% cdv_platform ios %} | *Default: CDVWebViewEngine* <br/> This sets the WebView engine plugin to be used to render the host app. The plugin must conform to the CDVWebViewEngineProtocol protocol. The 'value' here should match the 'feature' name of the WebView engine plugin that is installed. This preference usually would be set by the WebView engine plugin that is installed, automatically.
335
+
CrashRecoveryBehavior<br/>{% cdv_vartype string %} {% cdv_platform ios %} | *Default: refresh* <br/> Allowed values: refresh, reload <br/> Specifies the crash recovery behavior for the iOS web view. The `reload` option will cause the web view to reload the starting URL for the app, whereas `refresh` will attempt to restore the current URL state.
334
336
DefaultVolumeStream<br/>{% cdv_vartype string %} {% cdv_platform android %} | *Default: default* <br/> Added in cordova-android 3.7.0, This preference sets which volume the hardware volume buttons link to. By default this is "call" for phones and "media" for tablets. Set this to "media" to have your app's volume buttons always change the media volume. Note that when using Cordova's media plugin, the volume buttons will dynamically change to controlling the media volume when any Media objects are active.
335
337
DisallowOverscroll<br/>{% cdv_vartype boolean %} {% cdv_platform ios %} {% cdv_platform android %} | *Default: false* <br/> Set to **true** if you don't want the interface to display any feedback when users scroll past the beginning or end of content. On iOS, overscroll gestures cause content to bounce back to its original position. on Android, they produce a more subtle glowing effect along the top or bottom edge of the content. <br/>
336
338
EnableViewportScale<br/>{% cdv_vartype boolean %} {% cdv_platform ios %} | *Default: false* <br/> Set to true to allow a viewport meta tag to either disable or restrict the range of user scaling, which is enabled by default. Place a viewport such as the following in the HTML to disable scaling and fit content flexibly within the rendering WebView: <br/> ```<meta name='viewport' content='width=device-width, initial-scale=1, user-scalable=no' />```
Controls which network requests (images, XHRs, etc) are allowed to be made (via webview directly).
144
+
The [**Content Security Policy (CSP)**](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)`<meta>` tag is a very powerful mechanism that allows you to control trusted sources of content. You can restrict various content types and domains from which content can be loaded from. Unsafe and risky HTML and JavaScript can also be disabled to further increase the security of your app.
145
+
146
+
The CSP `<meta>` tag should be placed in your app's index.html file.
145
147
146
148
On Android and iOS, the network request allow list (see above) is not able to filter all types of requests (e.g. `<video>` & WebSockets are not blocked). So, in addition to the allow list, you should use a [Content Security Policy](http://content-security-policy.com/)`<meta>` tag on all of your pages.
147
149
150
+
> **Note**: If your app has multiple HTML files and navigates between them using the browser's navigation features, you should include the CSP in each file. If your app is a single-page application, you only need to include the CSP on `index.html`.
As a fallback, all other network requests are restricted to:
169
+
170
+
* The same origin as the app itself (`'self'`).
171
+
* Resources loaded via `data:` URIs.
172
+
* Resources from the specified external domain `https://ssl.gstatic.com`.
173
+
* JavaScript methods such as `eval()` (and similar) are permitted with `'unsafe-eval'`.
174
+
175
+
**Style Source (`style-src`):**
176
+
177
+
* Styles can only be loaded from the same origin (`'self'`).
178
+
* Inline styles (`'unsafe-inline'`) are also allowed, meaning styles can be directly applied using the `style` attribute on elements or within `<style>` tags.
179
+
180
+
**Media Source (`media-src`):**
181
+
182
+
* Media can be loaded from any source.
183
+
184
+
**Image Source (`img-src`):**
185
+
186
+
* Images can only be loaded from the same origin (`'self'`).
187
+
* Allows loading images from `data:` URIs.
188
+
* Allows loading images from `content:` URIs, typically used within the Android ecosystem.
189
+
190
+
### Example Content Security Policy Declarations
191
+
148
192
Here are some example CSP declarations for your `.html` pages:
149
193
150
194
```html
@@ -159,7 +203,7 @@ Here are some example CSP declarations for your `.html` pages:
159
203
<!-- Allow everything but only from the same origin and foo.com -->
You should fully understand the CSP tag and the various directives that can be specified. More documentation is available at [Content Security Policy](https://web.dev/articles/csp) (via Google Developers) and Mozilla's [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) article.
220
+
221
+
> **Tip**: If you're using web sockets, include `ws:` (`wss:` if using SSL) in the `connect-src` directive.
222
+
223
+
### Debugging Content Security Policy
224
+
225
+
When adding a CSP to your app, it's likely you'll encounter some issues. Fortunately, both Google Chrome's Developer Tools and Safari's Web Inspector make it very clear when a CSP violation occurs. Watch the console for any violation messages, which are typically quite detailed, specifying exactly which resource was blocked and why. Address each violation as they appear to ensure your CSP is properly configured.
226
+
175
227
## Other Notes
176
228
177
229
[Application Transport Security (ATS)](https://developer.apple.com/library/prerelease/ios/documentation/General/Reference/InfoPlistKeyReference/Articles/CocoaKeys.html#//apple_ref/doc/uid/TP40009251-SW33) is new in iOS 9 (Xcode 7). This new feature acts as an allow list for your app. Cordova CLI will automatically convert the `<access>` and `<allow-navigation>` tags to the appropriate ATS directives.
0 commit comments