Hi, I think that this code is wrong: https://github.com/apache/cordova-android/blob/master/framework/src/org/apache/cordova/Whitelist.java#L133
If the scheme is null then the scheme of the UrlPattern should be null. The UrlPattern class is coded to handle scheme==null as allow access. I think that a missing scheme should be handled as "*://host/path" NOT as "http://host/path || https://host/path";. In reality this does not make much difference though... -Axel Another thing: The definition of the W3C Widget element's access definition is that if port is missing the default port of the scheme must be used. I think that the UrlPattern matcher should know about default ports for well known schemes...
