Hacker News Reader

Comment by asadlionpk | Hacker News Reader

I hope Apple doesn't disable JS injection in WKWebViews in response to this. JS injection is the (only?) way to call native Swift methods from JS ie. bridging.

I am not sure what the solution here is. Maybe only allow injection to sites you control (via apple association file).

View on HN

Should only be allowed on domains one owns. Could be solved by DNS records or certificates.

Yup, apple association file is Apple's method of proving ownership to a domain.

Apple can just disallow in app browsers in the store policy. Require apps to call out to the default external browser.

The line is a bit blurry there. from a webview-based apps to just in-app browsers that opens when you tap a link in an app.

Sure but since the App Store is human review, they can tell the difference between a web view and an external website. Or just require the app to only call web views on their own domain or a whitelist of domains they submit with the app.

Wait, websites can call native Swift methods from JS?

Certainly. See https://developer.apple.com/documentation/webkit/wkscriptmes...

Only intentionally, via setup from a hosting app. If an app uses a WKWebView to display web content, it can use WKUserContentController[1] to inject scripts and additional content into the page dynamically, and can inject functions into JS[2] which will trigger native callback handlers when called.

If your app uses the JavaScriptCore[3] framework to run JS in a VM in-process directly, you have even more options for interfacing between JS and native code.

Note that this has to be explicitly hooked up by the app (i.e., none of this applies within, say, Safari).

[1]: https://developer.apple.com/documentation/webkit/wkuserconte...

[2]: https://developer.apple.com/documentation/webkit/wkuserconte...

[3]: https://developer.apple.com/documentation/javascriptcore

Short answer: yes

With the appropriate libraries you can use JS to call Swift and Obj C code.

Long answer: no

All it really means is that the JS and Swift/Obj C can pass data between each other and the library is set up to parse that data and call the appropriate code. It's just an automatic RPC.

I hope they do.

Same here. So many apps legitimately depend on these features, which makes me worried about an overreaction from Apple here.

A domain verification would be a huge hassle for me, since I provide an app builder that allows my non-technical customers to build an app (which includes a webview). Asking them to do domain verification would be tricky.

Check app bound domains.

Reply on news.ycombinator.com