A WebViewClient.onReceivedSslError(...) handler calls handler.proceed(), telling the WebView to ignore a TLS certificate error and load the page anyway.

Why this matters

This disables certificate validation for that WebView: an on-path attacker with any (expired, self-signed, wrong-host) certificate can serve the login/OAuth page and harvest the credentials and tokens the user enters (CWE-295). AI samples add proceed() to "make it work" against a dev server with a self-signed cert.

Never proceed on an SSL error in production. Cancel the load so the invalid certificate is rejected: override fun onReceivedSslError(view: WebView, handler: SslErrorHandler, error: SslError) { handler.cancel() } For a legitimately pinned/self-signed host, validate the certificate explicitly before deciding.

import android.net.http.SslError
import android.webkit.SslErrorHandler
import android.webkit.WebView
import android.webkit.WebViewClient

class MyClient : WebViewClient() {
    // ruleid: auth.kotlin.android.webview-ssl-error-proceed
    override fun onReceivedSslError(view: WebView, handler: SslErrorHandler, error: SslError) {
        handler.proceed()
    }
}

import android.net.http.SslError
import android.webkit.SslErrorHandler
import android.webkit.WebView
import android.webkit.WebViewClient

class MyClient : WebViewClient() {
    // rejects the invalid certificate: safe
    override fun onReceivedSslError(view: WebView, handler: SslErrorHandler, error: SslError) {
        handler.cancel()
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.kotlin.android.webview-ssl-error-proceed -- <reason>

References