---
title: "Cordova - Whitelist"  
description: "This is perhaps the last plugin left to learn in this Cordova series.    The Whitelist plugin allows us to apply whitelist policy for navigation in ap"  
author: "Anonymous User"  
published: 2017-05-04  
updated: 2018-03-19  
canonical: https://www.mindstick.com/blog/11373/cordova-whitelist  
category: "apache cordova"  
tags: ["mobile development", "apache cordova"]  
reading_time: 2 minutes  

---

# Cordova - Whitelist

This is perhaps the last plugin left to learn in this Cordova series.\

The Whitelist plugin allows us to apply whitelist policy for [navigation](https://www.mindstick.com/blog/62/different-navigation-in-asp-dot-net) in app. The whitelist plugin is installed and by default applied when you create new Cordova project. You can open the config.xml file to see allow-intent [default settings](https://answers.mindstick.com/qa/95596/how-do-i-reset-firefox-to-default-settings) provided by Cordova.

**Navigation Whitelist**

In the below example, we are allowing links to some external URL. This code is placed in config.xml. Navigation to file:// URLs is allowed by default.

```
<allow-navigation href = "http://example.com/*" />
```

The asterix sign, *, is used to allow navigation to [multiple values](https://www.mindstick.com/forum/399/how-to-insert-multiple-values-selected-in-checkbox-in-database). In the example above we are allowing navigation to all sub domains of the example.com. The same method can be applied to protocol or prefix to the host.

```
<allow-navigation href = "*://*.example.com/*" /> 
```

**Intent Whitelist**\

This also allow-intent element which is used to specify which URLs are allowed to open the system. You can see in the config.xml that Cordova already allowed most of the required links for us.

**Network Request Whitelist**

Inside config.xml file, there is <access origin="*" /> element. This element allows all network requests to our app through Cordova hooks. If you want to allow only specific requests, you can remove it from the config.xml and set it yourself.

The same rule is used as in previous examples.

```
<access origin = "http://example.com" />
```

All network requests from http://example.com will be allowed.

**[Content Security](https://answers.mindstick.com/qa/112149/how-do-i-implement-content-security-policy-csp-to-prevent-xss-attacks) Policy**\

Inside head element in index.html file, you can check out content security policy for your app.

```
<meta http-equiv = “Content-Security-Policy" content = "default-src
   'self' data: gap: https://ssl.gstatic.com 'unsafe-eval'; style-src
   'self' 'unsafe-inline'; media-src *">
```

If you want to allow everything from the same and example.com you can use – origin as this is a default configuration.

```
<meta http-equiv = "Content-Security-Policy" content = "default-src 'self' foo.com"> 
```

You also have [permission](https://www.mindstick.com/forum/159434/linux-service-permission-denied-error-adjust-permissions) to allow everything, but restrict CSS and [JavaScript](https://www.mindstick.com/articles/874/how-to-create-watermark-text-for-textbox-by-using-javascript) to the same origin.

```
<meta http-equiv = "Content-Security-Policy" content = "default-src *;
   style-src 'self' 'unsafe-inline'; script-src 'self'
   'unsafe-inline' 'unsafe-eval'">
```

We are recommending the default Cordova options here. Once you get familiar and involve in advanced [development](https://www.mindstick.com/articles/65309/importance-of-ux-design-in-the-development-of-mobile-apps) with Cordova, you can try some different values.

**Also read: [Apache Cordova – Geolocation](https://www.mindstick.com/blog/11365/apache-cordova-geolocation)**

#### [Apache Cordova- Globalization](https://www.mindstick.com/blog/11366/apache-cordova-globalization)

#### [Cordova- Dialog Plugin](https://www.mindstick.com/blog/11364/cordova-dialog-plugin)

---

Original Source: https://www.mindstick.com/blog/11373/cordova-whitelist

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.