CoreWebView2CustomSchemeRegistration.AllowedOrigins Property

Definition

Namespace:

Microsoft.Web.WebView2.Core

Assembly:

Microsoft.Web.WebView2.Core.dll

Package:

Microsoft.Web.WebView2 v1.0.3065.39

List of origins that are allowed to issue requests with the custom scheme, such as XHRs and subresource requests that have an Origin header.

C#

public System.Collections.Generic.List<string> AllowedOrigins { get; set; }

Property Value

List<String>

Remarks

The origin of any request (requests that have the [Origin header](https://developer.mozilla.org/docs/Web/HTTP/Headers/Origin)) to the custom scheme URI needs to be in this list. No-origin requests are requests that do not have an Origin header, such as link navigations, embedded images and are always allowed. Note that cross-origin restrictions still apply. From any opaque origin (Origin header is null), no cross-origin requests are allowed. If the list is empty, no cross-origin request to this scheme is allowed. Origins are specified as a string in the format of scheme://host:port. The origins are string pattern matched with * (matches 0 or more characters) and ? (matches 0 or 1 character) wildcards just like the URI matching in the AddWebResourceRequestedFilter(String, CoreWebView2WebResourceContext, CoreWebView2WebResourceRequestSourceKinds) API. For example, http://*.example.com:80.

Here's a set of examples of what is allowed or not:

	Request URI	Originating URL	AllowedOrigins	Allowed
	custom-scheme:request	https://www.example.com	{"https://www.example.com"}	Yes
	custom-scheme:request	https://www.example.com	{"https://*.example.com"}	Yes
	custom-scheme:request	https://www.example.com	{"https://www.example2.com"}	No
	custom-scheme-with-authority://host/path	custom-scheme-with-authority://host2	{""}	No
	custom-scheme-with-authority://host/path	custom-scheme-with-authority2://host	{"custom-scheme-with-authority2://*"}	Yes
	custom-scheme-without-authority:path	custom-scheme-without-authority:path2	{"custom-scheme-without-authority:*"}	No
	custom-scheme-without-authority:path	custom-scheme-without-authority:path2	{"*"}	Yes

Applies to