Android WebView中iframe直播嵌入提示移除sandbox属性问题求助

问题描述 #

我在Android WebView中嵌入的直播iframe已正常运行2年，上周突然出现异常——未做任何改动，该iframe在其他浏览器能正常加载，但WebView里却弹出「移除iframe的sandbox属性」错误。尝试给iframe添加sandbox="allow-scripts"后，又出现「Referrer check failed, null referrer not allowed」错误。

附相关代码 #

WebView配置代码

webView.setWebViewClient(new WebViewClient() {
    @Override
    public void onPageStarted(WebView view, String url, Bitmap favicon){
        super.onPageStarted(view, url, favicon);
        progressBar.setVisibility(View.VISIBLE);
        setTitle("Loading...");
    }
    @Override
    public void onPageFinished(WebView view, String url){
        super.onPageFinished(view, url);
        progressBar.setVisibility(View.GONE);
        setTitle(view.getTitle());
        view.loadUrl("javascript:onPageFinished();");
    }
    @Override
    public boolean shouldOverrideUrlLoading(WebView view, String url) {
        return !enableLinks;
    }
});

webView.setWebChromeClient(new MyChrome());
WebSettings webSettings = webView.getSettings();
webView.getSettings().setUserAgentString(newUA);

webSettings.setJavaScriptEnabled(true);
webView.getSettings().setJavaScriptEnabled(true);
webView.setInitialScale(85);
webView.setBackgroundColor(Color.TRANSPARENT);

webView.setLayerType(View.LAYER_TYPE_HARDWARE, null);
webView.getSettings().setRenderPriority(WebSettings.RenderPriority.HIGH);

webSettings.setMediaPlaybackRequiresUserGesture(false);
webSettings.setDomStorageEnabled(true);
if (Build.VERSION.SDK_INT >= 21) {
    webView.setLayerType(View.LAYER_TYPE_HARDWARE, null);
}
else {
    webView.setLayerType(View.LAYER_TYPE_SOFTWARE, null);
}
webSettings.setLayoutAlgorithm(WebSettings.LayoutAlgorithm.NARROW_COLUMNS);

webView.getSettings().setLoadWithOverviewMode(true);
webView.getSettings().setUseWideViewPort(true);

webSettings.setSavePassword(true);
webSettings.setSaveFormData(true);
webSettings.setEnableSmoothTransition(true);

webSettings.setAllowFileAccess(true);
webSettings.setAllowContentAccess(true);
webSettings.setAllowUniversalAccessFromFileURLs(true);
webSettings.setAllowFileAccessFromFileURLs(true);

webSettings.setJavaScriptCanOpenWindowsAutomatically(true);

if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN) {
    webSettings.setAllowFileAccessFromFileURLs(true);
    webSettings.setAllowUniversalAccessFromFileURLs(true);
}

webView.loadUrl("file:///android_asset/willow_TV.html");

iframe标签代码

<iframe frameborder="0" marginheight="0" marginwidth="0" style="position:fixed;" src="https://crichdplayer.xyz/embed2.php?id=willow&q=Willow Cricket" scrolling="yes" width="100%" height="512" allowfullscreen=true webkitallowfullscreen mozallowfullscreen allowfullscreen >Your Browser Do not Support Iframe</iframe>

解决方案 #

1. 修复空Referrer问题 #

你通过file:///android_asset/加载本地页面，WebView默认不会发送Referrer，导致直播源服务器拦截。可以用两种方式解决：

• 自定义Referrer头：在WebViewClient中重写方法，手动添加合法的Referrer

@Override
public boolean shouldOverrideUrlLoading(WebView view, WebResourceRequest request) {
    String targetUrl = request.getUrl().toString();
    if (targetUrl.contains("crichdplayer.xyz")) {
        Map<String, String> headers = new HashMap<>();
        headers.put("Referer", "https://www.example.com"); // 替换为直播源允许的白名单域名
        view.loadUrl(targetUrl, headers);
        return true;
    }
    return super.shouldOverrideUrlLoading(view, request);
}

• 改用HTTPS加载页面：把willow_TV.html部署到HTTPS服务器，用https://协议加载，WebView会自动发送合法Referrer。

2. 调整Sandbox权限（配合Referrer修复） #

不要只设置allow-scripts，添加直播必需的权限：

<iframe frameborder="0" marginheight="0" marginwidth="0" style="position:fixed;" 
        src="https://crichdplayer.xyz/embed2.php?id=willow&q=Willow Cricket" 
        scrolling="yes" width="100%" height="512" 
        sandbox="allow-scripts allow-same-origin allow-popups allow-top-navigation allow-media"
        allowfullscreen webkitallowfullscreen mozallowfullscreen>
    Your Browser Do not Support Iframe
</iframe>

各权限作用：

• allow-same-origin：允许iframe页面使用同源策略，避免跨域限制
• allow-popups：支持直播可能需要的弹窗功能
• allow-top-navigation：允许页面导航到顶层窗口
• allow-media：保障直播媒体正常播放

3. 对齐浏览器User-Agent #

当前自定义的newUA可能和普通浏览器差异过大，导致服务器拦截。可以改用Chrome移动端UA：

String chromeUA = "Mozilla/5.0 (Linux; Android 10; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36";
webView.getSettings().setUserAgentString(chromeUA);

4. 开启第三方Cookie支持 #

如果直播源依赖Cookie验证，需开启Cookie权限：

CookieManager cookieManager = CookieManager.getInstance();
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
    cookieManager.setAcceptThirdPartyCookies(webView, true);
} else {
    cookieManager.setAcceptCookie(true);
}

内容的提问来源于stack exchange，提问作者Kez XI