iframe does not work with "frame-ancestors *" CSP (iOS WKWebView ) #1537
Description
Bug Report
Problem
On iOS, an iframe cannot embed a page where the server sets a frame-ancestors * Content Security Policy.
This is despite allowing navigation in the config.xml
<access origin="*" />
<allow-navigation href="https://*.menti.com/*" />
<platform name="ios">
<preference name="scheme" value="app"/>
</platform>
What is expected to happen?
The iframe content should load
What does actually happen?
On iOS, the iframe fails to load with
Refused to load https://www.menti.com/xyz because it does not appear in the frame-ancestors directive of the Content Security Policy.
On Android, the iframe loads as expected. Possibly because Android allows the app to use the https:// scheme.
Information
It seems that * does not match the iOS scheme, which is app:// in my case. Presumably it would match https://, but that is not allowed by Apple.
This might not be fixable on the Cordova side, but there was no bug report documenting the issue.
This can worked around on the server side by explicitly allowing the scheme, if you control the server side.
As an example, typeform did this here: Typeform/embed#311
I don't know any other workaround.
Environment, Platform, Device
cordova-ios version 7.1.1
Checklist
- I searched for existing GitHub issues
- I updated all Cordova tooling to most recent version
- I included all the necessary information above