Our app uses ASWebAuthenticationSession for login.
This launches an incognito (ephemeral) browser window of the system’s default browser with the authentication URL.
Recently, on the latest macOS Tahoe, we observe that:
The browser application is launched(we could see in the dock)
But the authentication window with the URL does not appear
No error is returned to the app (silent failure)
General
RSS for tagExplore the integration of web technologies within your app. Discuss building web-based apps, leveraging Safari functionalities, and integrating with web services.
Selecting any option will automatically load the page
Post
Replies
Boosts
Views
Activity
I'm not loving the huge Favorites icons in Safari on MacOS 26, is there a way to reduce the size of them so that we can see more favorites on the list without scrolling down?
I’ve been working on a personal iOS project for fun — essentially a YouTube music player, learning how background media playback works in native iOS apps.
After seeing that Musi (a famous music streaming app) can play YouTube audio in the background with the screen off — I got really curious. I’ve been trying to replicate that basic background audio functionality for YouTube embeds using WKWebView. I've spent a crazy amount of time (probably 20 hours) trying to figure this out but have achieved no success.
Here’s what I’ve tried so far:
-Embedding a YouTube video in a WKWebView
-Activating AVAudioSession with .playback and setting .setActive(true)
-Adding the UIBackgroundModes key with audio in Info.plist
-Adding the NSAppTransportSecurity key to allow arbitrary loads
--Testing on a real device (iPhone 14, iOS 18.1 target)--
What happens:
Audio plays fine in the foreground.
If I exit the app and go to the lock screen quickly enough (less than 3 seconds) after pressing play, I can resume playback briefly from the lock screen — but it doesn’t automatically continue like in Musi and other apps like it.
Most of the time, the audio stops when the app is backgrounded.
I get this error consistently in the logs:
Error acquiring assertion: <Error Domain=RBSServiceErrorDomain Code=1 "(originator doesn't have entitlement com.apple.runningboard.assertions.webkit AND originator doesn't have entitlement com.apple.multitasking.systemappassertions)"
It seems like the app lacks some specific entitlements related to WebKit media playback. I don’t have AppDelegate/SceneDelegate (using SwiftUI), but can add if needed.
I’m super curious how music streaming apps using youtube as a source get around this — are they doing something different under the hood? A custom player? A SafariViewController trick? Is there a specific way to configure WKWebView to keep playing in the background, or is this a known limitation?
Would really appreciate any insight from folks who’ve explored this before or know how apps like Musi pulled it off.
Thanks in advance!
I'm creating an iPad app using Xcode 26 Beta 6. I have the following simple code and web page, but when I tap the file selection button, nothing appears. Do I need to add any additional code?
code
struct SwiftUIWebView: View {
@State private var webPage = WebPage()
private let url = URL(string: "https://www.xxxx.com/")!
var body: some View {
WebView(webPage)
.onAppear {
webPage.load(URLRequest(url: url))
}
}
}
web page
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>Test</title>
</style>
</head>
<body>
<div id="container">
<input type="file" />
</div>
</body>
</html>
Cross posting from Spatial Computing, apologies if this is not the appropriate forum. The purpose is to create a simple web-based gallery of spatial photos and videos using static html files. I have successfully displayed spatial photos using the img tag and IMG.heic files. I can tap and hold the image to bring up the contextual menu and from there select View Spatial Photo. Is there any way to add a control to the image, like a link or overlay on the image itself, that a user can simply tap to show the image in 3D? And how to host a (small!) video file on a web page without going through a CDN/streaming service? Sample html would be much appreciated.
Hello,
We are experiencing a behavior change with WKWebView related to upgradeKnownHostsToHTTPS.
Current application, we explicitly disable automatic HTTPS upgrades:
let config = WKWebViewConfiguration()
config.upgradeKnownHostsToHTTPS = false
Observed behavior
iOS 17.5 (built with Xcode 15.3)
http:// image URLs are not automatically upgraded to https://, and the behavior works as expected.
iOS 18.5 / 18.6.x (built with Xcode 16.4)
http:// image URLs appear to be automatically upgraded to https:// by WebKit, even when upgradeKnownHostsToHTTPS is explicitly set to false.
This behavior occurs for subresource requests such as <img src="http://..."> inside a WKWebView.
Question
Has the behavior of upgradeKnownHostsToHTTPS changed in iOS 18 / Xcode 16?
Is this property now ignored for certain types of subresource requests (e.g. images), or overridden by new WebKit security policies such as mixed-content HTTPS upgrades?
Any clarification or official guidance would be greatly appreciated!.
How can I make a background image take the entire screen in ios26?
I've tried position fixed, sticky, env() css variables but nothing worked. It does it when in PWA mode, but I would like to do so in the browser too.
Our UI-less share extension (com.apple.services) appears in Safari and Chrome. We raise a popup "Open in (app)..." via the Action.js script document.location.href = urlScheme://... in Safari.
However, in Chrome, while our extension executes, parses the URL item attachment from Chrome, it never triggers that popup or opens our app.
How can a UI-less share extension open our app from Chrome?
Is the accepted practice, despite guidelines, turning the com.apple.ui-services view controller invisible and auto-openURLing? Several apps on the store appear to do this, immediately popping their app without any confirmation dialog or UI in both Safari and Chrome. https://stackoverflow.com/a/79369242
"We have a multi-tenant EdTech platform serving over 1500 clients, each with a unique domain (e.g., client1.eduapp.com). We use WKWebView in a native shell. Due to WKAppBoundDomains restriction, we can't dynamically list all domains. How can we support dynamic tenants while maintaining cookie persistence"
"Can Apple suggest a best practice or alternative approach for apps using WebView/PWA shell architecture across multiple client domains?"
Problem:
We cannot predefine all 1500 domains in WKAppBoundDomains due to limitations.
As a result:
Service workers fail to register, breaking PWA functionality Ex: Offline.
Topic:
Safari & Web
SubTopic:
General
Hi Apple Devs & WebKit Team,
We operate https://excnum.com — a personal website currently under reconstruction. It's HTTPS-secure, hosted on a clean VPS, and now features a simple placeholder page with no active forms, scripts, or external redirects.
However, Safari on both iOS and macOS is flagging it as a “deceptive website”, blocking all access. This warning appears even though:
The site uses a valid SSL certificate via Cloudflare
There are no redirects, tracking scripts, or dynamic code
We serve a static landing page (“under maintenance”) with zero interaction
No malware, phishing, or obfuscation exists — verified with multiple tools
A review request has already been submitted at: https://websitereview.apple.com
We believe the site may have been blacklisted previously under past ownership or prior configurations. It has since been completely restructured and cleared, but the Safari warning persists.
This false flag is harming visibility and trust for an otherwise neutral website.
Any advice on how to expedite re-evaluation or request a manual delisting from the deceptive site list would be much appreciated.
Thank you!
— Alex
Admin, EXCNUM.COM
Hello,
I’m working on a cross-origin WebAuthn implementation where a parent page embeds an iframe from a different origin to perform authentication. According to the WebAuthn Level 3 spec (Section 7.1.1), when crossOrigin is true, the clientDataJSON may include topOrigin—but Safari does not seem to populate this field.
Observed Behavior:
Chrome/Firefox: Include topOrigin in clientDataJSON when crossOrigin: true.
Safari (macOS/iOS): Omits topOrigin even though crossOrigin is correctly set to true.
Example clientDataJSON from Safari:
{
"type": "webauthn.get",
"challenge": "...",
"origin": "https://iframe-origin.example.com",
"crossOrigin": true
// Missing `topOrigin` (expected: parent origin)
}
Questions:
Is this an intentional omission in Safari for privacy/security reasons?
Are there specific requirements (e.g., HTTP headers, permissions policies) needed for Safari to expose topOrigin?
Is there a known workaround to reliably obtain the top-level origin in cross-origin WebAuthn flows?
System Info:
Version 18.4 (20621.1.15.11.10)
OS: Sequoia Version 18.4 (20621.1.15.11.10)
Reproduction Steps:
Parent page (https://parent.example.com) embeds an iframe (https://webauthn-rp.example.com).
The iframe calls navigator.credentials.get() with a WebAuthn challenge.
Safari returns clientDataJSON with crossOrigin: true but no topOrigin.
Code Snippet (iframe):
const credential = await navigator.credentials.get({
publicKey: {
challenge: new Uint8Array(/* ... */),
rpId: 'webauthn-rp.example.com',
allowCredentials: [],
hints: [],
userVerification: "preferred",
}
});
console.log(JSON.parse(atob(credential.response.clientDataJSON)));
Has anyone encountered this? Any insights would be greatly appreciated!
Topic:
Safari & Web
SubTopic:
General
I have multiple web views of the same domain that share the same local storage, as expected.
One of them though, is loading a .webarchive file.
The web archive is of the same domain, and is loaded using the same base URL.
For some reason, in most cases, the local storage is not shared with this web view when loading the web archive, although if I make that same web view load the actual live web page it does share local storage.
I say in most cases, because for some users it works as expected, but for a significant portion of users it isn't sharing local storage.
I think that the main difference between working and not is iOS version. iOS 17 seems to be able to share the local storage but iOS 18 does not. I can't find anything related in the release notes of iOS 18 versions.
There is nothing in the documentation for load(_:mimeType:characterEncodingName:baseURL:), or the header file, that explains anything specific about local storage and webarchive loading.
Does anyone know for sure how local storage is handled when a webarchive is loaded into a web view, and did something change with iOS 18 in regards to this?
Hello I am trying to release an app, dealing with storing, delivering, and maintaining outdoor activity euqipememts.
On web, I used widget provided by TOSS, which is a Korean banking application. Due to lack of time I have use lazy method
User taps the “Pay” button
↓
Backend generates a payment URL (Toss Payments)
↓
Open the payment page in an external browser (Safari)
↓
User completes the payment in Safari
↓
Return to the app via deep link (borini://payment/success)
↓
Call the payment approval API
↓
Display the payment completion page
I have hear such method is possible for our type of service which deals with real life goods.
So I would love to know if it is actually possible or will I have to make a new payment method using apple provided payment method in order to pass APP Store Connect review before releasing application
Hello
We've encountered an issue with WKWebView in the latest iOS 26 beta. When loading a PDF URL, the background of the PDF viewer now displays as a dark gray instead of the expected white.
Device: iOS 26 Simulator/Device
Component: WKWebView
Issue: The background color of the loaded PDF is gray.
Expected Behavior: The background should be white, as it has been in all previous iOS versions.
Link for Testing: https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf
We confirmed that the same PDF and code render with a white background on iOS 26 and earlier.
Questions:
Is this an intentional change in iOS 26's WKWebView?
If so, is there a new property or configuration setting available to control the background color of the PDF viewer within WKWebView? We would like to have the ability to set it back to white.
Any insights, workarounds, or information on this matter would be greatly appreciated.
Thank you.
My app has been published by 2 months now I still I cant get Universal Links to work.
I checked a lot of docs as well as videos about setting up universal links. Everyone with clear steps:
Add the well-known json file to the server. Already validated by AASA web validator.
Add the Associated domain on project capabilities, with the Web page root only. Eg: applinks:example:com.
Install the app and trying clicking a link from notepad. Or instead make a long press to deploy contextual menu to see if my app is on the selectable options to open the link.
My app is not been open in any of my attempts and the console always trying to use safari.
I had a couple of screenshots of my testing. I really need help with this.
When our Safari Web Extension makes a api request from its background script (registered via "scripts" in manifest.json, e.g., "background": { "scripts": ["js/background.bundle.js"] }) to our authenticated API endpoint (https://api-domain/user), the Cookie header is not included in the request. This occurs only when the extension is running within a non-default Safari User Profile. This causes our API to treat the user as unauthenticated. The exact same extension code, manifest, and API call work correctly (Cookie header is present and user is authenticated) when the extension is running in the Default Safari User Profile.
I integrated Apple Pay on the web following the documentation, and verified that the payment works successfully in the sandbox environment using Safari on iOS and Mac. Later, I launched the Apple Pay payment code on a third-party web page that supports Apple Pay, and scanned the code with the camera of an eligible iOS device. The camera then displayed the Apple Pay button; after tapping it, a brief pop-up message saying ‘Service Unavailable’ appeared, and then it closed automatically. How can I troubleshoot and resolve this issue?
Topic:
Safari & Web
SubTopic:
General
ios drop file wrong file name
I use the following simple JS code to drag file from the browser to the desktop.
Works perfect on MacOS.
onDragStart(event, ucpView) {
let file = new BrowserFile([this.file.fileContent], this.file.displayName, {
type: 'application/ucp-scenario'
});
const fileURL = URL.createObjectURL(file);
event.dataTransfer.setData("DownloadURL", `application/octet-stream:${file.name}:${fileURL}`);
event.dataTransfer.setData("text/uri-list", fileURL);
}
but on iOS it keeps nameing the file
Text1.txt
Text2.txt
...
and ignores the DownloadURL
whats the best way to get it workng on both OS?
Topic:
Safari & Web
SubTopic:
General
Hey team, I've integrated custom WkWebsiteDatastore to manage profiling for different sessions.
upon testing the WkWebsiteDataStore as its mentioned to be persistent But
The storage can be accessed via identifier, But the session data in storage is absent, such as cookies caches all are cleared when app is relaunched
is it the default behavior to be expected or there is some property missing causing the session data to be removed from storage.
Dears,
We are facing some issue in ios 18.4.1. Recently some of our end users who updated their ios devices to 18.4.1 have experienced random 403 errors in runtime. as per our analysis, We identified that these errors are associated with "CSRF token mismatch".
After successful login, the user's CSRF token is causing issue and it was changed in runtime, this causes the cookie mismatch, and the users is getting 403 errors, and the user session is getting invalid suddenly.
let me know if anyone facing the same issue in ios 18.4.1 and let me know Is there any workaround for this issue.
Thanks.