[CB-10709] Allow-navigation rule for iFrame urls on cordova-ios

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 6.0.0
• Fix Version/s: cordova-ios@5.0.0
• Component/s: cordova-ios
• Labels: backlog cordova-ios-4.1.1 triaged
• Assignee: Shazron Abdullah
• Reporter: Harsha Kiran
• Created: 26/Feb/16 19:12
• Updated: 30/Jul/20 04:13

Description

Currently with Whitelist plugin set to <allow-navigation="://domain.com/"> doesn't allow navigation to other domains including urls embedded using iframe on iOS.
EG: If I tried to embed a youtube video using iframe tag with only this rule <allow-navigation="://domain.com/">, it doesn't allow loading of the video in iframe as youtube.com is not listed in allowed domains.
If we add <allow-navigation="://youtube.com/"> it allows the loading of iframe but will also allow navigation to youtube.com using Javascript i.e window.open('http://youtube.com').

With current implementation in cordova-ios, I'm not sure if there is any solution to allow a domain navigation in iframe and not allow navigation to that domain using other methods like javascript.

Android ignores the allow-navigation rule for iframe loaded urls, so iOS should be modified to behave the same?

Issue Links

• relates to: CB-12455 iframes are governed by whitelist as well, not just top-level navigations