cordova-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Brien Colwell <>
Subject Re: I replaced XMLHttpRequest and image loading with a plugin, and wrote up my experiences
Date Tue, 17 Feb 2015 23:47:04 GMT
Hi Tommy,

Really interesting. I just added a reference to your plugin in the 
Nextop plugin docs :)

At the moment Nextop is focused on loading speed with a custom network 
stack. Security is a huge issue for us (we want to be a faster and more 
secure solution), and we will be pinning at least our own certificate at 
some point.

If I had to rank priorities for Nextop, they would be:

1. speed
2. ease of use - be able to use it without any code change
3. security

So it seems like our projects complement each other. It would be rad to 
think about a super-set of them.


On 2/17/15 1:29 PM, Tommy Williams wrote:
> Oops, forgot the link.
> On 18 Feb 2015 8:28 am, "Tommy Williams" <> wrote:
>> Interesting work. I like how you really went the extra mile.
>> This is essentially what we have had to do at SpiderOak in order to have
>> certificate pinning in a Cordova app.
>> We use the Cordova-HTTP plugin[1] and a JavaScript shim to send all of our
>> xhr API calls through it, then we have a modified fork of the file-transfer
>> plugin for downloading files etc. Both of these plugins support certificate
>> pinning and, by the end of this week, certificate authentication as well.
>> Have you considered adding certificate pinning to your plugin to make it a
>> more secure option than the browser xhr?
>> On 18 Feb 2015 2:49 am, "Andrew Grieve" <> wrote:
>>> Neat stuff! Thanks for sharing.
>>> On Tue, Feb 17, 2015 at 5:42 AM, Brien Colwell <> wrote:
>>>> Hi All,
>>>> I spent some time researching how much of the webview network stack I
>>>> could replace with a Cordova plugin on Android. I wrote a post about it
>>> -
>>>> docs/
>>>> The take away is that a Cordova can fully replacing the default XHR and
>>>> image loading in the webview for async=true, but it can't do async=false
>>>> (but who uses that anyway :/). This is cool because plugins can
>>> experiment
>>>> with new wire protocols to get data to the client.
>>>> Best,
>>>> Brien
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail:
>>>> For additional commands, e-mail:

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message