I tried putting a HTTP URL in a Messenger Webview and the bot is crashing.
Yes, per Facebook Messenger's documentation, Webviews have to be HTTPS and they have to be whitelist in the Page Settings. For more details, take a look at Facebook Messenger's documentation on Whitelisting URLs.