content: Android Capacitor origin is `https://localhost` by default, not `http://localhost`

Open Beginner friendly
#4,546 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
80/100
Issue type
Documentation
Clarity
Clearly specified
Activity status
Quiet
Tech stack
android
Domain
documentation

Research direction

Open the CORS troubleshooting page at the issue's URL and review the paragraph describing Capacitor origins. Update it to state that Android uses https://localhost by default, explain the server.androidScheme override, and confirm the wording matches the linked Capacitor configuration references.

Written by the indexing model from the issue text.

Description

triage
URL

https://ionicframework.com/docs/troubleshooting/cors#what-is-cors

Issue Description

Summary

The CORS docs state that the Android origin is http://localhost. On current Capacitor this is https://localhost by default, because server.androidScheme defaults to https. The current wording leads people to whitelist the wrong origin and get blocked requests on Android.

What the docs say

From the CORS page:

An origin is the combination of the protocol, domain, and port from which your Ionic app or the external resource is served. For example, apps running in Capacitor have capacitor://localhost (iOS) or http://localhost (Android) as their origin.

What actually happens

On a default Capacitor app (no androidScheme set), the Android webview origin is https://localhost, not http://localhost.

Tested on Capacitor 7 with a production backend. The server logged the incoming Origin header per platform:

Android        origin = https://localhost
iOS / iPadOS   origin = capacitor://localhost

The CORS allowlist only started working on Android after adding https://localhost. Adding http://localhost had no effect.

Why

Since Capacitor 6 made https the default androidScheme, the default Android origin is https://localhost. Per the config reference, the origin is androidScheme + hostname. It is http://localhost only if you set androidScheme: 'http'. Also raised in #3639.

Suggested wording

Apps running in Capacitor have capacitor://localhost (iOS) or https://localhost (Android) as their origin by default. The Android scheme follows server.androidScheme, which defaults to https. It is http://localhost only if you set androidScheme: 'http'.

If this looks right, I am happy to open a PR with the change.

Dominant language
MDX
Stars
621
Forks
3.2k
Avg merge
1d 2h
Merged PRs (30d)
86

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ionic-team/ionic-docs

All issues in ionic-team/ionic-docs

Similar issues

More Documentation issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.