WebView having vulnerability even after putting Network Security Configuration file in >API 24

Question

Can any one help to remove the vulnerability in my android webview. I already put NSC file and certificate of my website but still getting vulnerability.

Answer 1

override the onReceivedSslError method inside setWebViewClient with user choice to proceed.

 @Override
public void onReceivedSslError(WebView view, SslErrorHandler handler, SslError error) {
                    AlertDialog.Builder builder = new AlertDialog.Builder(requireNonNull(getActivity()));
                    AlertDialog alertDialog = builder.create();
                    String message = getString(R.string.ssl_error_msg);
                    switch (error.getPrimaryError()) {
                        case SslError.SSL_UNTRUSTED:
                            message = getString(R.string.ssl_untrusted);
                            break;
                        case SslError.SSL_EXPIRED:
                            message = getString(R.string.ssl_expired);
                            break;
                        case SslError.SSL_IDMISMATCH:
                            message = getString(R.string.ssl_host_mismatch);
                            break;
                        case SslError.SSL_NOTYETVALID:
                            message = getString(R.string.ssl_not_yet_valid);
                            break;
                    }

                    message += getString(R.string.do_you_want_to_continue_anyway);
                    alertDialog.setTitle(getString(R.string.ssl_cert_error_msg));
                    alertDialog.setMessage(message);
                    alertDialog.setButton(DialogInterface.BUTTON_POSITIVE, "OK", (dialog, which) -> {
                        // Ignore SSL certificate errors
                        handler.proceed();
                    });

                    alertDialog.setButton(DialogInterface.BUTTON_NEGATIVE, "Cancel", (dialog, which) -> {
                        //myWebView.loadUrl(_URL);
                        handler.cancel();
                        dismiss();
                    });
                    alertDialog.show();
                }