Cordova Advanced HTTP Plugin
raw JSON →cordova-plugin-advanced-http is a Cordova/PhoneGap plugin that enables mobile applications to perform HTTP requests using native networking capabilities, offering significant advantages over standard JavaScript requests. Key differentiators include robust SSL/TLS pinning for enhanced security, bypassing browser-imposed CORS restrictions, support for X.509 client certificate-based authentication, and improved handling of HTTP 401 Unauthorized responses. The current stable version is 3.3.1. While there isn't an explicit release cadence, the project is actively maintained with updates detailed in its `CHANGELOG.md`. This plugin is particularly valuable for applications requiring secure communication channels and those needing to circumvent typical webview networking limitations on iOS, Android, and Browser platforms.
Common errors
error ReferenceError: cordova is not defined ↓
document.addEventListener('deviceready', function() { /* plugin code here */ }, false); block. error Failed to establish TLS connection: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found. ↓
.cer files are DER-encoded, up-to-date, and correctly placed in platforms/android/app/src/main/assets/certificates (or www/certificates in older setups). Ensure you are pinning against the correct server certificate or a valid intermediate/root CA. error Native: tried calling HTTP.post, but the HTTP plugin is not installed. Install the HTTP plugin: 'ionic cordova plugin add cordova-plugin-advanced-http' ↓
cordova-plugin-advanced-http is installed (ionic cordova plugin add cordova-plugin-advanced-http) and that @ionic-native/http is also installed (npm install @ionic-native/http). Ensure your app.module.ts correctly declares and provides HTTP from @ionic-native/http/ngx. Sometimes, rebuilding the project (ionic cordova platform rm android && ionic cordova platform add android) is necessary. error Error: A network error occurred. ↓
config.xml and platform-specific manifests have necessary network permissions (e.g., android.permission.INTERNET, android.permission.ACCESS_NETWORK_STATE). Warnings
gotcha The plugin is a global object (`cordova.plugin.http`) and is only available after the `deviceready` event fires. Attempting to use it before this event will result in `ReferenceError: cordova is not defined` or `cordova.plugin.http is undefined`. ↓
breaking Abort functionality for sent requests is not working reliably. Applications relying on the ability to cancel in-flight HTTP requests may experience unexpected behavior or resource leaks. ↓
gotcha SSL/TLS Pinning requires specific configuration. You must include DER-encoded `.cer` certificates in your app's `www/certificates` folder (or project root for iOS, `platforms/android/assets` for Android). Incorrectly configured certificates or an attempt to pin against a revoked/expired certificate will lead to connection failures. ↓
gotcha Debugging network requests made through this plugin can be challenging as they are handled natively and do not appear in the browser's developer tools (e.g., Safari's network tab for iOS). This makes inspecting request/response headers and bodies difficult. ↓
gotcha The `setDataSerializer` method's `urlencoded` option does not support serializing deep (nested) JavaScript objects, whereas `json` does. Using `urlencoded` with complex data structures will lead to incorrect payload formatting. ↓
deprecated The `AndroidBlacklistSecureSocketProtocols` preference allows disabling insecure SSL/TLS protocols, which is critical for security. However, its effectiveness depends on correctly identifying and blacklisting outdated protocols (e.g., `SSLv3`, `TLSv1`). Failure to update this list as new vulnerabilities emerge can leave the application exposed. ↓
Install
npm install cordova-plugin-advanced-http yarn add cordova-plugin-advanced-http pnpm add cordova-plugin-advanced-http Imports
- cordova.plugin.http wrong
import { http } from 'cordova-plugin-advanced-http';correctdocument.addEventListener('deviceready', () => { /* use cordova.plugin.http here */ }, false); - cordova.plugin.http.get wrong
import { get } from 'cordova-plugin-advanced-http/http';correctcordova.plugin.http.get('https://example.com/api/data', {}, {}, (response) => { /* success */ }, (response) => { /* error */ }); - cordova.plugin.http.setHeader wrong
const { setHeader } = require('cordova-plugin-advanced-http');correctcordova.plugin.http.setHeader('*', 'Authorization', 'Bearer mytoken');
Quickstart
document.addEventListener('deviceready', onDeviceReady, false);
function onDeviceReady() {
console.log('Cordova is ready. Initializing Advanced HTTP plugin.');
const http = cordova.plugin.http;
const API_BASE_URL = 'https://jsonplaceholder.typicode.com';
// Set a global header for all requests
http.setHeader('*', 'X-Custom-Header', 'MyValue');
console.log('Set global custom header.');
// Set data serializer to JSON for POST/PUT requests
http.setDataSerializer('json');
console.log('Set data serializer to JSON.');
// Perform a GET request
http.get(
`${API_BASE_URL}/posts/1`,
{ /* parameters */ },
{ /* headers */ },
(response) => {
console.log('GET Success:', response.status, JSON.parse(response.data));
},
(response) => {
console.error('GET Error:', response.status, response.error);
}
);
// Perform a POST request
const postData = { title: 'foo', body: 'bar', userId: 1 };
http.post(
`${API_BASE_URL}/posts`,
postData,
{ 'Content-Type': 'application/json' }, // Can override global serializer's content type
(response) => {
console.log('POST Success:', response.status, JSON.parse(response.data));
},
(response) => {
console.error('POST Error:', response.status, response.error);
}
);
// Example of using SSL pinning (requires .cer files in www/certificates)
// Uncomment and configure if you have .cer files
/*
http.setServerTrustMode('pinned', () => {
console.log('SSL pinning enabled.');
}, (error) => {
console.error('Failed to enable SSL pinning:', error);
});
*/
}