[HybridWebView] Add the ability to intercept all web resource requests

[mattleibow]

Description of Change

Note

I have created demo repo with the NuGet packages from the PR (but for .NET 9)
https://github.com/mattleibow/MauiHybridWebViewInterceptionDemo

Intercepting requests before they leave the browser will allow for the addition of headers as well as cancellation of the requests.

The API is only really fully shapeable once all the platforms are complete as each platform is really different, but the idea I have right now is a mix of all the platforms.

// CONTROLS  /  XAML

public class HybridWebView : IHybridWebView
{
    // new event where all things are happening
    public event EventHandler<HybridWebViewWebResourceRequestedEventArgs>? WebResourceRequested;
}

public class HybridWebViewWebResourceRequestedEventArgs
{
    // access to the platform-specific features
    public PlatformHybridWebViewWebResourceRequestedEventArgs? PlatformArgs { get; }

    // general properties
    public Uri Uri { get; }
    public string Method { get; }
    public IReadOnlyDictionary<string, string> Headers { get; }
    public IReadOnlyDictionary<string, string> QueryParameters { get; }

    // flag property to indicate that the app will continue processing
    public bool Handled { get; set; }

    // if the event is handled, then one of these MUST be called before the event handler returns
    public void SetResponse(int code, string reason, IReadOnlyDictionary<string, string>? headers, Stream? content);
    public void SetResponse(int code, string reason, IReadOnlyDictionary<string, string>? headers, Task<Stream?> contentTask);

    // some APIs that are extension method overloads in the extensions class (HybridWebViewWebResourceRequestedEventArgsExtensions)
    //
    // no data returned, typically a error or redirect
    // public void SetResponse(int code, string reason);
    //
    // data returned, but no headers except the content type
    // public void SetResponse(int code, string reason, string contentType, Stream? content);
    // public void SetResponse(int code, string reason, string contentType, Task<Stream?> contentTask);
}

// Extension methods that make things easier (see more info on the main event args)
public static class HybridWebViewWebResourceRequestedEventArgsExtensions
{
    public static void SetResponse(this HybridWebViewWebResourceRequestedEventArgs e, int code, string reason);

    public static void SetResponse(this HybridWebViewWebResourceRequestedEventArgs e, int code, string reason, string contentType, Stream? content);
    public static void SetResponse(this HybridWebViewWebResourceRequestedEventArgs e, int code, string reason, string contentType, Task<Stream?> contentTask);
}

public class PlatformHybridWebViewWebResourceRequestedEventArgs
{
#if WINDOWS

    // Platform event sender
    public global::Microsoft.Web.WebView2.Core.CoreWebView2 Sender { get; }
    // Platform event args
    public global::Microsoft.Web.WebView2.Core.CoreWebView2WebResourceRequestedEventArgs RequestEventArgs { get; }
    // Platform event args request (convenience)
    public global::Microsoft.Web.WebView2.Core.CoreWebView2WebResourceRequest Request { get; }

#elif IOS || MACCATALYST

    // Platform event sender
    public global::WebKit.WKWebView Sender { get; }
    // Platform event args
    public global::WebKit.IWKUrlSchemeTask UrlSchemeTask { get; }
    // Platform event args request (convenience)
    public Foundation.NSUrlRequest Request { get; }

#elif ANDROID

    // Platform event sender
    public global::Android.Webkit.WebView Sender { get; }
    // Platform event args
    public global::Android.Webkit.IWebResourceRequest Request { get; }
    // User response instance to return to the bowser (mut always be set if event is handled)
    public global::Android.Webkit.WebResourceResponse? Response { get; set; }

#endif
}


// CORE

public class WebResourceRequestedEventArgs
{
#if WINDOWS
    public global::Microsoft.Web.WebView2.Core.CoreWebView2 Sender { get; }
    public global::Microsoft.Web.WebView2.Core.CoreWebView2WebResourceRequestedEventArgs RequestEventArgs { get; }
#elif IOS || MACCATALYST
    public global::WebKit.WKWebView Sender { get; }
    public global::WebKit.IWKUrlSchemeTask UrlSchemeTask { get; }
#elif ANDROID
    public global::Android.Webkit.WebView Sender { get; }
    public global::Android.Webkit.IWebResourceRequest Request { get; }
    public global::Android.Webkit.WebResourceResponse? Response { get; set; }
#endif
}

public interface IHybridWebView : IView
{
    bool WebResourceRequested(WebResourceRequestedEventArgs args);
}

Tasks

• WebView
  • Android
  • iOS/macOS
  • Windows
• HybridWebView
  • Android
  • iOS/macOS
  • Windows
• BlazorWebView
  • Android
  • iOS/macOS
  • Windows

Issues Fixed

Fixes #11382

---

Implementation Restrictions

• Android
  • Android does not directly allow "intercept-and-continue" for requests. The implementation is to rather notify you that a request is about to happen and you can either replace the whole request or do nothing and let the webview do it.
  • Android does not support custom schemes.
• iOS/Mac Catalyst
  • iOS and Mac Catalyst do NOT allow interception of http and https requests:
    https://developer.apple.com/documentation/webkit/wkwebviewconfiguration/seturlschemehandler(_:forurlscheme:)#parameters

    It is a programmer error to register a handler for a scheme WebKit already handles, such as https ...

Platform	Intercept HTTPS	Intercept Custom Schemes	Request Modification
Android	✅	❌	❌
iOS	❌	✅	❌
Mac Catalyst	❌	✅	❌
Windows	✅	⚠ 1	✅

Notes:

• 1: I seem to not get the event to fire but this is maybe because the WebView2 in .NET MAUI is a bit older that the fix. The [Windows] Upgrade to Windows App SDK 1.7 #28499 PR should update things.

[Copilot]

Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.

Files not reviewed (1)

• src/Controls/tests/DeviceTests/Resources/Raw/HybridTestRoot/index.html: Language not supported

Comments suppressed due to low confidence (2)

src/Core/src/Handlers/HybridWebView/HybridWebViewHandler.Windows.cs:241

• Switching to a universal filter '*' may intercept more requests than intended, including external resources. Consider verifying that this change does not introduce performance impacts or unintended side effects.

webView.CoreWebView2.AddWebResourceRequestedFilter("*", CoreWebView2WebResourceContext.All);

src/Controls/samples/Controls.Sample/Pages/Controls/HybridWebViewPage.xaml.cs:22

• [nitpick] The string literal 'badthing' is used directly in the condition; consider extracting it into a named constant to improve readability and ensure consistency.

if (e.PlatformArgs.WebResourceRequestedEventArgs.Request.Uri.Contains("badthing", StringComparison.InvariantCultureIgnoreCase))

[mattleibow]

Maybe if we land this, we won't need a "proxy" endpoint as all endpoints will become proxy-able: #25867

[mattleibow]

/backport to release/10.0.1xx-preview4

[github-actions]

Started backporting to release/10.0.1xx-preview4: https://github.com/dotnet/maui/actions/runs/14839378964

[mattleibow]

/rebase

[rmarinho]

/rebase

[rmarinho]

Testing on iOS and Android seems to work as expected if I set Handled=true but Android we do load more things

Android	iOS

macOS	Windows

[rmarinho]

Windows seems to also not load the base page

[mattleibow]

Test failures are unrelated