Switch to using POST for .NET method invoke #32104

mattleibow · 2025-10-21T01:27:35Z

This pull request introduces significant improvements to the HybridWebView's .NET invocation security and request handling, as well as updates to the related test infrastructure and JavaScript interop logic. The changes enforce stricter validation of incoming requests to the __hwvInvokeDotNet endpoint, ensuring only properly formed POST requests with required headers and bodies are processed. Comprehensive device tests and supporting HTML/JS files have been added to verify these behaviors across platforms.

HybridWebView .NET Invocation Security & Request Handling

The HybridWebView handler now strictly validates requests to the __hwvInvokeDotNet endpoint: only POST requests with the correct X-Maui-Invoke-Token and X-Maui-Request-Body headers and a non-empty body are accepted; others are blocked with appropriate HTTP status codes (400 Bad Request, 405 Method Not Allowed). [1] [2] [3]
Refactored the .NET invocation logic to deserialize request data from the POST body or header, removing reliance on query strings and improving platform compatibility. [1] [2] [3]

JavaScript Interop and API Updates

Updated the JavaScript and TypeScript logic to send POST requests with the required headers and body to the __hwvInvokeDotNet endpoint, matching the new server-side requirements. The request and response handling code was also improved for better error handling and data deserialization. [1] [2] [3] [4] [5]

Device Test Infrastructure

Added a new device test suite (HybridWebViewTests_InvokeDotNetFails.cs) and corresponding HTML test page (invokedotnetfails.html) to verify that invalid requests (wrong method, missing/invalid headers, empty body, iframe context) are blocked and only valid requests succeed. [1] [2]

Cross-Platform and Build System Improvements

Refactored handler code to use a platform-agnostic HeaderPairType for header handling, improving maintainability and cross-platform support. [1] [2]
Improved TypeScript build configuration to allow overriding the compile block condition via the TypeScriptCompileBlocked property.

Future Improvements

Right now, Windows, iOS and Mac Catalyst use a POST with a body, but Android is limited and has to use a header. In future, switching to a [JavascriptInterface] may be worth investigation.
This could also be expanded into a non-HTTP request and just use the same messaging system that the other invokes use.

Copilot

Pull Request Overview

This PR migrates the HybridWebView's .NET method invocation from GET requests with URL-encoded query strings to POST requests with JSON bodies. This change removes URL length limitations and enables future extensibility. The implementation differs slightly by platform: Windows, iOS, and macOS use standard POST bodies, while Android works around platform limitations by using a custom header to transmit the request body.

Key changes:

Changed JavaScript fetch calls from GET to POST with JSON body
Added security validation through custom headers (X-Maui-Invoke-Token)
Implemented platform-specific body handling (stream for iOS/Windows/Mac, header for Android)
Added comprehensive test coverage for validation failures

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`MauiHybridWebViewClient.cs`	Android implementation: validates POST requests and reads body from custom header
`HybridWebViewHandler.iOS.cs`	iOS/MacCatalyst implementation: validates POST requests and reads body from NSData stream
`HybridWebViewHandler.cs`	Shared handler: updated method signature to accept stream or string body instead of query string
`HybridWebViewHandler.Windows.cs`	Windows implementation: validates POST requests and reads body from request content stream
`HybridWebView.ts`	TypeScript client: changed from GET with query string to POST with JSON body and headers
`HybridWebView.js`	JavaScript client: transpiled version of TypeScript changes
`Core.csproj`	Build configuration: allows conditional override of TypeScript compilation blocking
`invokedotnetfails.html`	Test HTML page: provides test functions for validation failure scenarios
`HybridWebViewTests_InvokeDotNetFails.cs`	Unit tests: validates security checks and proper error handling

src/Core/src/Platform/Android/MauiHybridWebViewClient.cs

src/Core/src/Handlers/HybridWebView/HybridWebViewHandler.cs

jsuarezruiz

/Users/builder/azdo/_work/1/s/src/Core/src/Handlers/HybridWebView/HybridWebViewHandler.cs(194,66): error CS8604: Possible null reference argument for parameter 'json' in 'JSInvokeMethodData? JsonSerializer.Deserialize<JSInvokeMethodData>(string json, JsonTypeInfo<JSInvokeMethodData> jsonTypeInfo)'. [/Users/builder/azdo/_work/1/s/src/Core/src/Core.csproj::TargetFramework=netstandard2.0]
    1 Error(s)

rmarinho · 2025-10-22T23:38:03Z

/rebase

rmarinho · 2025-10-24T18:12:13Z

/backport to release/10.0.1xx

github-actions · 2025-10-24T18:12:27Z

Started backporting to release/10.0.1xx (link to workflow run)

Using GET was simpler, but required everything to be on the URL and URL encoded. There is a limit to the number of chars. Using a POST message allows for longer but also fits in with the ability to extend later with different features. Right now, Windows, iOS and Mac Catalyst use a POST with a body, but Android is limited and has to use a header. In future, switching to a [JavascriptInterface] may be worth investigation. Fix the tests whatever mac no idea some ws Some versions of Android fail with missing headers

mattleibow · 2025-10-28T16:24:56Z

/backport to release/10.0.1xx

github-actions · 2025-10-28T16:25:07Z

Started backporting to release/10.0.1xx (link to workflow run)

Copilot

Pull Request Overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Copilot · 2025-10-28T16:28:07Z

src/Core/src/Handlers/HybridWebView/HybridWebViewHandler.cs

+		internal const string InvokeDotNetTokenHeaderValue = "HybridWebView";
+		internal const string InvokeDotNetBodyHeaderName = "X-Maui-Request-Body";
+
+


Multiple consecutive blank lines detected. Remove one of the blank lines to follow standard formatting practices.

Suggested change

Copilot · 2025-10-28T16:28:07Z

src/Controls/tests/DeviceTests/Resources/Raw/HybridTestRoot/invokedotnetfails.html

+            // iframe.frameBorder = '0';
+            // iframe.loading = 'lazy';
+            // iframe.allowTransparency = 'true';
+            // iframe.allowFullscreen = 'true';


Commented-out code should be removed. If these iframe attributes are not needed for the test, delete them. If they may be needed in the future, document why they are preserved as comments.

Suggested change

// iframe.frameBorder = '0';

// iframe.loading = 'lazy';

// iframe.allowTransparency = 'true';

// iframe.allowFullscreen = 'true';

The base branch was changed.

Copilot AI review requested due to automatic review settings October 21, 2025 01:27

mattleibow added this to MAUI SDK Ongoing Oct 21, 2025

github-project-automation bot moved this to Todo in MAUI SDK Ongoing Oct 21, 2025

mattleibow added the p/0 Current heighest priority issues that we are targeting for a release. label Oct 21, 2025

mattleibow added this to the .NET 10.0 GA milestone Oct 21, 2025

Copilot AI reviewed Oct 21, 2025

View reviewed changes

src/Core/src/Platform/Android/MauiHybridWebViewClient.cs Show resolved Hide resolved

src/Core/src/Handlers/HybridWebView/HybridWebViewHandler.cs Show resolved Hide resolved

jsuarezruiz suggested changes Oct 21, 2025

View reviewed changes

github-project-automation bot moved this from Todo to Changes Requested in MAUI SDK Ongoing Oct 21, 2025

github-actions bot force-pushed the dev/hybridwebview-post-invoke branch from b5f1c22 to 988aba9 Compare October 22, 2025 23:38

github-actions bot mentioned this pull request Oct 24, 2025

[release/10.0.1xx] Switch to using POST for .NET method invoke #32204

Closed

mattleibow force-pushed the dev/hybridwebview-post-invoke branch from 988aba9 to bd78699 Compare October 28, 2025 14:49

mattleibow force-pushed the dev/hybridwebview-post-invoke branch from 8dc3d45 to d536066 Compare October 28, 2025 16:24

github-actions bot mentioned this pull request Oct 28, 2025

[release/10.0.1xx] Switch to using POST for .NET method invoke #32246

Merged

mattleibow requested a review from Copilot October 28, 2025 16:27

Copilot AI reviewed Oct 28, 2025

View reviewed changes

rmarinho previously approved these changes Oct 28, 2025

View reviewed changes

rmarinho changed the base branch from net10.0 to main October 29, 2025 10:36

rmarinho requested a review from jsuarezruiz October 29, 2025 10:36

mattleibow merged commit 9d861e9 into main Oct 29, 2025
158 of 163 checks passed

mattleibow deleted the dev/hybridwebview-post-invoke branch October 29, 2025 20:58

github-project-automation bot moved this from Changes Requested to Done in MAUI SDK Ongoing Oct 29, 2025

github-actions bot locked and limited conversation to collaborators Nov 29, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Switch to using POST for .NET method invoke #32104

Switch to using POST for .NET method invoke #32104

Uh oh!

mattleibow commented Oct 21, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

jsuarezruiz left a comment

Uh oh!

rmarinho commented Oct 22, 2025

Uh oh!

rmarinho commented Oct 24, 2025

Uh oh!

github-actions bot commented Oct 24, 2025

Uh oh!

mattleibow commented Oct 28, 2025

Uh oh!

github-actions bot commented Oct 28, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 28, 2025

Uh oh!

Copilot AI Oct 28, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		internal const string InvokeDotNetTokenHeaderValue = "HybridWebView";
		internal const string InvokeDotNetBodyHeaderName = "X-Maui-Request-Body";

Switch to using POST for .NET method invoke #32104

Switch to using POST for .NET method invoke #32104

Uh oh!

Conversation

mattleibow commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

jsuarezruiz left a comment

Choose a reason for hiding this comment

Uh oh!

rmarinho commented Oct 22, 2025

Uh oh!

rmarinho commented Oct 24, 2025

Uh oh!

github-actions bot commented Oct 24, 2025

Uh oh!

mattleibow commented Oct 28, 2025

Uh oh!

github-actions bot commented Oct 28, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mattleibow commented Oct 21, 2025 •

edited

Loading