How I fixed Google Play’s “unsafe implementation of the WebViewClient.onReceivedSslError handler” warning in Takipsly.
With one Takipsly update I received a policy violation notice from Play Console: the app was handling SSL errors in WebView unsafely, and I had a deadline to fix it. The whole problem came down to a single line.
What was wrong?
When WebView loads a page and finds a problem with the certificate (expired, domain mismatch, an untrusted root certificate and so on), it calls onReceivedSslError. Many code samples implement it like this:
override fun onReceivedSslError(
view: WebView?,
handler: SslErrorHandler?,
error: SslError?
) {
handler?.proceed() // Ignore the error and keep loading the page
}That code says “carry on no matter what the certificate looks like”. An attacker on the same network can sit in the middle with a fake certificate and read the traffic, including the password the user types. Google Play scans for this pattern automatically and sends a warning. If you don’t fix it in time, you can’t publish updates with the affected version.
The fix
The default behaviour on an error should be to cancel loading:
override fun onReceivedSslError(
view: WebView?,
handler: SslErrorHandler?,
error: SslError?
) {
handler?.cancel()
// Show the user a clear message
showError("This connection isn't secure. Please check your network and try again.")
}Not overriding the method at all is also a valid fix, because WebView cancels by default. I chose to override it so the user sees an explanation instead of a blank screen.
Things to watch out for
- A conditional
proceed()is risky too. If you added a check like “only proceed in the development environment”, make sure that code never makes it into the release build. Play’s scan looks at the code itself, not at which branch actually runs. - Check your dependencies. Sometimes the warning comes not from your own code but from an old ad or analytics library. The warning details in Play Console show the class name, which tells you which package it comes from.
- Test it. Open test sites such as badssl.com in your WebView and confirm the app really stops loading.
Once the fixed version passes review, the warning in Play Console is closed. That may not happen immediately, so don’t leave it until the last day.