I have a web app, which has an embedded map field, which is implemented using an iframe to https://maps.google.com/...
I am porting our app (which runs as a home screen icon currently) to Cordova on iOS, so adding a Cordova wrapper. We already run the app via Cordova on Android.
I have a div
, with a child element
<iframe src="https://maps.google.com/?iwloc=&output=embed&q=something"></iframe>
Initially, when the Cordova project was concerned only with Android, I had in config.xml
<access origin="*" />
<access origin="file://*" />
<access origin="http://*" />
<allow-navigation href="http://*" />
However, this does not work. The iframe
with the map url doesn't even attempt to load, and there is no indication why.
So I started reading up and playing around with these settings, and on iOS basically, all they do is map to NSAppTransportSecurity
settings in Info.plist
.
Turns out that <allow-navigation href="http://*" />
is ignored completely, only allow-navigation that specify domains or just * are supported, so I tried the more specific domain based ones, such as
<allow-navigation href="http://maps.google.com/*" />
Which does create a domain entry for maps.google.com
and sets NSExceptionAllowsInsecureHTTPLoads
to true
but still the iframe won't load.
The ONLY thing I can find that allows the iframe to load the maps URL is by adding
<allow-navigation href="*"/>
Which essentially sets NSAllowsArbitraryLoads
to true
which basically turns TLS off, and will trigger an app review and require justification.
SideNote: <access origin="*"/>
also sets NSAllowsArbitraryLoads
to true
but alone prevents the initial URL from loading inside the webview (it loads externally).
I am at a bit of a loss as to what combination of config.xml or NSAppTransportSecurity
settings I need to get this working without just allowing everything and the app review issues that will undoubtedly trigger.
Note: These requests don't trigger a CSP warning, I don't think the webview is even getting that far, and if I set allow-navigation to * it works, which would suggest CSP is fine.
When it fails, all I get in web debugger for that request is 'an error occurred trying to load the resource', and nothing in XCode console.