diff --git a/docs/html/training/articles/security-tips.jd b/docs/html/training/articles/security-tips.jd index e05b44cbe5a85..3215a0ea4e34d 100644 --- a/docs/html/training/articles/security-tips.jd +++ b/docs/html/training/articles/security-tips.jd @@ -445,7 +445,17 @@ locally. Server-side headers like no-cache can also be used to indicate that an application should not cache particular content.

- +

Devices running platforms older than Android 4.4 (API level 19) +use a version of {@link android.webkit webkit} that has a number of security issues. +As a workaround, if your app is running on these devices, it +should confirm that {@link android.webkit.WebView} objects display only trusted +content. You should also use the updatable security {@link +java.security.Provider Provider} object to make sure your app isn’t exposed to +potential vulnerabilities in SSL, as described in Updating Your +Security Provider to Protect Against SSL Exploits. If your application must +render content from the open web, consider providing your own renderer so +you can keep it up to date with the latest security patches.

Handling Credentials