Not so long ago Cordova Android version 10 have been announced. This version gives ability to serve the app within webview container over https protocol (while file:// was previous default). Are there any strong reasons to use https over http or file protocols in this particular case. I know that https is encrypted by default and is fundamental for web page/apps security. But in case Cordova where app files are served locally and there is not entry point for attacker (I assume he cannot abuse serving local files because he cannot access the webview container) what is the reason?

CodePudding user response：

The reason is that file does not provide an valid origin required by CORS. This is only useful if you use a framework like Angular that requires it, from my understanding. Also, iOS wkwebview requires all resources to have an origin unless you bypass that with a plugin. So I guess, to also be standard with iOS requirements and some frameworks across the board.