[CB-7348] [WKWebView] pages that are loaded using file:/// urls respect CORS

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Not A Problem
• Component/s: cordova-ios
• Labels: cordova-ios-4.0.x

Environment

iOS 8

• Assignee: Shazron Abdullah
• Reporter: Shazron Abdullah
• Created: 20/Aug/14 20:36
• Updated: 23/Aug/18 07:10
• Resolved: 11/Sep/15 22:31

Description

Not a complaint but an advisory, this is the opposite of what happens in a UIWebView, where a page loaded locally is not restricted to CORS and can do whatever it wants.

Try xhr to a local server using: https://gist.github.com/enjalot/2904124

Note that it works with the wildcard of course. By default, file:// urls give the Origin: header as null.

The only solution is, the destination server MUST return the header "Access-Control-Allow-Origin" that matches the wildcard or "null".

So what is the alternative? Run a local proxy. The PhoneGap Developer App does this transparently: https://github.com/phonegap/phonegap-app-developer by overriding XMLHttpRequest.open