Android 10 - How can I assign the root path?

Sorry in advance if my english is not so good.

As breautek wonderfully explain here https://github.com/apache/cordova-android/issues/1354#issuecomment-921752541 , with Android 10 Platform (the mximum platform available at the moment on Cordova and the minimum platform required to publish on playstore) “XHR not CORS request” and “file://” not working if I don’t set on my config.xml

<preference name="hostname" value="localhost" />
<preference name="AndroidInsecureFileModeEnabled" value="true" />

I’m pretty sure that this solution is useful… but temporary. I’m sure the PlayStore will impose a new restriction shortly and this solution will be in vain.

So I decided to not use them and carry on… I have solved my problem about XHR CORS request but I have no solution about how to set the root path… for example to assign it an image path

At the moment I get it as:

var urlRootMobile=cordova.file.applicationDirectory+'www/';
var img1 = urlRootMobile."/img/1.png";
var img2 = urlRootMobile."/img/2.png";
var img3 = urlRootMobile."/img/3.png";

Obviously don’t work on my app because the path is : " file:///android_asset/www/img/1.png"

I tried to use “https://localhost/www” I tried to use “https://localhost” I tried to use “/” But nothing…

I there some other command or trick ???

[breautek]

I would advise to only use the cordova.file constants in conjunction with the cordova file plugin apis. They will always reference file paths through the file protocol. So they may work with AndroidInsecureFileModeEnabled turned on, but you will run into problems when it’s turned off.

I would recommend working towards making your app compatible with AndroidInsecureFileModeEnabled turned off. Any file you bundle with your app by placing into the www folder will be available using relative pathing, and it will work cross-platform.

If you’re creating dynamic content and writing files during runtime, using the file plugin, then it is ok to continue using the file plugin and it’s constants to read that data or to resolve filesystem urls, but trying to use these paths with the webview will not work when AndroidInsecureFileModeEnabled is turned off.

[breautek]

Root paths aren’t assignable in Android.

If you’re using the filesystem strategy (e.g. <preference name="AndroidInsecureFileModeEnabled" value="true" />) then the root is file:///android_assets which is a special android folder that leads to the running process assets directory. Generally, cordova apps have a www folder for their web assets. By default your index.html file will be located at file:///android_assets/www/index.html

When using the filesystem strategy, / as root path will mean the literal android root folder, which is often unreadable or limited access to non-privileged applications.

If you’re using the WebViewAssetLoader strategy (e.g. <preference name="AndroidInsecureFileModeEnabled" value="false" />), then the webview uses a system where as far as the webview is concerned, it is loading content from an http or https resource. By default, cordova is configured to use the domain https://localhost, but this is configurable via:

<preference name="scheme" value="https" />    <!-- scheme can only accept "http" or "https" on android -->
<preference name="hostname" value="localhost" />

The configured scheme/domain will point to your www folder, therefore assuming the default configuration, your index.html file will be at https://localhost/index.html

I’m pretty sure that this solution is useful… but temporary. I’m sure the PlayStore will impose a new restriction shortly and this solution will be in vain.

It’s advised against using the AndroidInescureFileModeEnabled because Google has deprecated the setting in API 30, stating:

Don’t enable this setting if you open files that may be created or altered by external sources. Enabling this setting allows malicious scripts loaded in a file:// context to launch cross-site scripting attacks, either accessing arbitrary local files including WebView cookies, app private data or even credentials used on arbitrary web sites.

While I agree that this shouldn’t be your primary solution, it should be an option for the foreseeable future.

cordova.file.applicationDirectory

This is a filesystem constant that is the absolute path to your app’s Application Directory. If you’re using this path while using the WebViewAssetLoader system, you will get CORS error because you’re requesting a file:// protocol url over a https origin.

Assuming you’re using WebViewAssetLoader, If you have an image in <cordova-project>/www/img/image1.jpg for example, and you have your HTML documented loaded at <cordova-project>/www/index.html, then all you need to do is request "img/image1.jpg"