Advanced Configuration
Configure URL allowlists and other advanced settings for the Airship Flutter SDK.
This guide covers advanced configuration options for the Airship Flutter SDK.
URL Allowlist
The URL allowlist is a security feature that controls which URLs the Airship SDK can open or interact with. This prevents malicious or unintended URLs from being accessed through your app.
The SDK divides URL usage into three different config options:
urlAllowListScopeOpenUrl: Controls URLs that can be opened from actions, landing pages, HTML in-app messages, or In-App Automation media. By default, allows Airship-originated URLs and YouTube URLs.
urlAllowListScopeJavaScriptInterface: Controls which URLs can have the Airship JavaScript interface injected into webviews. By default, allows only Airship-originated URLs.
urlAllowList: Applies both scopes to the specified URLs.
URL pattern syntax
<pattern> := '*' | <scheme>'://'<host>/<path> | <scheme>'://'<host> | <scheme>':/'<path> | <scheme>':///'<path>
<scheme> := <any char combination, '*' are treated as wild cards>
<host> := '*' | '*.'<any char combination except '/' and '*'> | <any char combination except '/' and '*'>
<path> := <any char combination, '*' are treated as wild cards>Example allowlist configurations
var config = AirshipConfig(
defaultEnvironment: ConfigEnvironment(
appKey: "YOUR_APP_KEY",
appSecret: "YOUR_APP_SECRET"
),
site: Site.us,
// Allow all URLs (use with caution in production)
urlAllowList: ["*"]
);// Allow specific domains
var config = AirshipConfig(
defaultEnvironment: ConfigEnvironment(
appKey: "YOUR_APP_KEY",
appSecret: "YOUR_APP_SECRET"
),
site: Site.us,
urlAllowList: [
"https://yourwebsite.com",
"https://*.yourwebsite.com/*" // All subdomains
]
);// Allow specific URL patterns with different scopes
var config = AirshipConfig(
defaultEnvironment: ConfigEnvironment(
appKey: "YOUR_APP_KEY",
appSecret: "YOUR_APP_SECRET"
),
site: Site.us,
urlAllowListScopeOpenUrl: [
"https://yourwebsite.com/*",
"https://youtube.com/*",
"yourapp://*" // Deep link scheme
],
urlAllowListScopeJavaScriptInterface: [
"https://yourwebsite.com/*"
]
);Setting urlAllowList to ["*"] allows the SDK to open any URL. While convenient for development, this should be carefully considered for production environments. Only include specific domains you trust.
These config options are passed to Airship.takeOff() during SDK initialization. See the Flutter Setup guide for complete initialization instructions.
Categories