WKWebView custom URL scheme doesn't work with https? (mixed content blocked)

Question

I have a WKWebView to load a website that has a custom url scheme (mycustomurl://) implemented with WKURLScheme, which the website will call using GET. Everything works as expected when the website is in http://, but breaks when I switch to https:// with the following error:

[blocked] The page at https:// (url snipped) was not allowed to display insecure content from mycustomurl://(url snipped). 

The WKURLScheme callback was never hit, so I suspect Safari or higher power blocked it :/

I already comb through SO discussions on ATS, none of it worked. I did saw some discussions like this one that mentioned this is because Safari blocks mixed content, and when I tried it directly on Safari it did generate the same result (blocked).

There seems to be no solution to this? It seems we can't turn off Safari's mixed content restriction. Then how should custom URL scheme be used and implemented because https should always a better choice than http?

I did notice most custom URL scheme tutorials have http instead of https...

Answer 1

Not sure this answer is still relevant but an actual working solution is to use a custom WKUrlSchemeHandler to load the initial https-page from.

I recently faced a similar issue (trying to connect to a WebSocket server on device from a https-page) and the only way I found to get this working while still keeping the application secured by https was the following not-so-nice workaround:

• register your custom WKUrlSchemeHandler for mycustomurl://
• register a second custom WKUrlSchemeHandler, let's say myapp-remote://
• inside webView:startURLSchemeTask::
  • retrieve the request url from the urlSchemeTask.Request
  • replace myapp-remote:// with https://
  • create a NSURLDataRequest with the https-url
  • return the response and fetched data to the urlSchemeTask

With this setup you can fetch your https-Page by using myapp-remote:// as schema for the initial load, keeping TLS security as well as validation and also have working mycustomurl:// references that your WKWebView won't block.

My implementation is in C# for Xamarin but I can provide it for clarity if it's needed.