html

HTML contents of the webview.

This should be a complete, valid html document. Changing this property causes the webview to be reloaded.

Webviews are sandboxed from normal extension process, so all communication with the webview must use message passing. To send a message from the extension to the webview, use postMessage. To send message from the webview back to an extension, use the acquireVsCodeApi function inside the webview to get a handle to the editor's api and then call .postMessage():

<script>
    const vscode = acquireVsCodeApi(); // acquireVsCodeApi can only be invoked once
    vscode.postMessage({ message: 'hello!' });
</script>

To load a resources from the workspace inside a webview, use the asWebviewUri method and ensure the resource's directory is listed in WebviewOptions.localResourceRoots.

Keep in mind that even though webviews are sandboxed, they still allow running scripts and loading arbitrary content, so extensions must follow all standard web security best practices when working with webviews. This includes properly sanitizing all untrusted input (including content from the workspace) and setting a content security policy.

Online Documentation