Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using the new phonegap 1.5.0 (which is confusingly renamed cordova despite no mention of the rename on the phonegap site), and I'm finding that the white-listing feature on iOS is quite restrictive. I understand that having a whitelist is more secure in that it only allows trusted domains, but what if you want to load urls that have been loaded dynamically? You don't know exactly which domain will be loading, so you can't put it on the whitelist. An example use-case would be ad-serving and opening privacy policies.

Why is the whitelist mandatory, and is there a way around it?

share|improve this question
See here: – Robert Harvey Mar 9 '12 at 19:20
On the name change: PhoneGap, Cordova, and what’s in a name? – Caleb May 22 '12 at 19:03
up vote 1 down vote accepted

What is the purpose of whitelisting in Phonegap?

As you guessed, it's a security measure. Specifically, it's meant to prevent cross-site scripting attacks as detailed on the Security page of the PhoneGap wiki.

Why is the whitelist mandatory, and is there a way around it?

The question linked by Robert Harvey in the comments explains how to get around it. In short, add an entry to the whitelist with the value * to allow access to any URL. (Think thrice before doing that, though -- make sure you understand the danger that the whitelist is there to mitigate.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.