Explore the integration of web technologies within your app. Discuss building web-based apps, leveraging Safari functionalities, and integrating with web services.

All subtopics
Posts under Safari & Web topic

Post

Replies

Boosts

Views

Activity

Apple Pay Web: Multiple active PPCs for one Merchant ID?
Hi,
 We’re implementing Apple Pay on the Web for a multi-tenant platform via a PSP. The PSP operates multiple HSM/clusters and gave us multiple CSRs, asking us to register all.
Our understanding: a Merchant ID can hold several PPCs over time, but only one is active at once. Questions Is there any supported way to keep more than one PPC active simultaneously for the same Merchant ID? If not, what does Apple recommend for web-only, multi-tenant setups: a single MID with PSP-side decryption & sub-merchant separation, or separate MIDs per brand/region? Any official guidance on PPC rotation and handling many domains for Apple Pay on the Web? links to official docs or prior Apple responses would be appreciated.
2
0
1.3k
Jun ’26
Safari shows “Fraudulent Website Warning” for a clean domain. How to request re-evaluation?
Hello, Safari on iOS is showing a “Fraudulent Website Warning” for our domain: https://doobler.ru/ We are trying to understand how to properly diagnose this and request a re-evaluation. The website has a valid HTTPS certificate and does not currently appear to be flagged by the reputation tools we checked, including Google Safe Browsing / Search Console / VirusTotal. However, some iPhone users still see the Safari warning, while others do not. What we have checked so far: HTTPS certificate is valid No mixed-content or obvious redirect issues found Google Safe Browsing does not show the domain as unsafe Google Search Console does not show security issues VirusTotal does not show active malware/phishing detections The warning appears only for some users/devices We submitted a review request through Apple’s Website Review form, but have not received any response yet We would like to know: Is there any way to confirm whether the warning comes from Apple’s own reputation system, Google Safe Browsing, or another provider used by Safari? How long does Apple Website Review usually take for Safari fraudulent website warnings? Is there a recommended process for requesting re-evaluation if the warning appears to be a false positive? Are there specific technical signals Safari checks that we should verify, such as redirects, third-party scripts, domain reputation, or brand/phishing heuristics? This is affecting real users, so any guidance on the correct escalation or diagnostic path would be appreciated. Thank you.
0
0
336
Jun ’26
iOS 26 Safari & WebView: VisualViewport.offsetTop not reset after keyboard dismissal, causing fixed elements misplacement
1. System/device combinations where the issue does not occur: Physical device: iOS 26.0 (23A5318c) + iPhone 16 Pro Max 2. System/device combinations where the issue does occur: System versions: Physical device: iOS 26.0 (23A5330a), iOS 26.0 (23A340) Simulator: iOS 26.0 (23A339) Device models: Physical device: iPhone 12 Reproducible in Safari, WKWebView, and UIWebView: Yes Actual behavior In WebView (and identically in Safari): Before the keyboard is shown, header/footer elements with position: fixed are correctly aligned with the screen viewport. Scrolling up/down works as expected. After the keyboard appears, the visualViewport position changes. Bug: When the keyboard is dismissed, visualViewport.offsetTop does not reset to 0. As a result, fixed header/footer elements remain misaligned: When scrolling down, the position looks correct. When scrolling up, the header/footer are visibly offset. Steps to reproduce Focus an input field → the keyboard appears Dismiss the keyboard Observe that visualViewport.offsetTop remains >0 (does not reset to zero) position: fixed header/footer elements are misplaced relative to the screen Expected behavior After the keyboard is dismissed, visualViewport.height should return to match the layout viewport, and visualViewport.offsetTop should reset to 0. When scrolling upward, fixed elements should remain correctly positioned within the layout viewport. Minimal reproducible demo A simple HTML file containing: A header and footer with position: fixed An input element to trigger the keyboard <!DOCTYPE html> <html lang="zh-CN"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" /> <title>H5 吸顶吸底页面 Demo</title> <style> * { margin: 0; padding: 0; box-sizing: border-box; } body { font-family: Arial, sans-serif; height: 2000px; /* 设置内容高度 */ background-color: #f0f8ff; /* body 背景浅蓝色 */ padding-top: 120px; /* 预留 header 高度 */ padding-bottom: 60px; /* 预留 footer 高度 */ overflow-x: hidden; } /* 吸顶 Header */ header { position: fixed; top: 0; left: 0; width: 100%; height: 120px; background-color: #ff6b6b; /* 红色 */ display: flex; align-items: center; justify-content: center; color: white; font-size: 24px; font-weight: bold; z-index: 1000; } /* 吸底 Footer */ footer { position: fixed; bottom: 0; left: 0; width: 100%; height: 60px; background-color: #4ecdc4; /* 青绿色 */ display: flex; align-items: center; justify-content: center; color: white; font-size: 18px; font-weight: bold; z-index: 1000; } /* 输入框样式 */ .input-container { margin: 100px auto; width: 80%; max-width: 600px; text-align: center; } input[type='text'] { padding: 12px; font-size: 16px; border: 2px solid #ddd; border-radius: 8px; width: 100%; box-sizing: border-box; } input[type='text']:focus { outline: none; border-color: #4ecdc4; } </style> </head> <body> <!-- 吸顶 Header --> <header>吸顶 Header (120px)</header> <!-- 主体内容 --> <div class="input-container"> <input type="text" placeholder="请输入内容..." /> </div> <!-- 吸底 Footer --> <footer>吸底 Footer (60px)</footer> </body> </html>
28
27
24k
Jun ’26
Multilanguage in a WebView App on iPhone
I have a WebView App for my WordPress site. For multilanguage support I am using gTranslate. This works fine on any browser (also Safari) and also in my App on Android - but it does NOT work on iPhones. gTranslate is using GoogleTranslate. On iPhones it is kicked on correctly, but just does not translate the page. Do you have any clue why this is the case? What is hindering gTranslate (Google-Translate) to run on iPhones? My WebViews is starting with this - do I need something special for iOs?: <WebView style={{ flex: 1 }} ref={webViewRef} source={{ uri: initialUrl }} applicationNameForUserAgent={APP_AGENT} javaScriptEnabled={true} domStorageEnabled={true} sharedCookiesEnabled={true} cacheEnabled={false} thirdPartyCookiesEnabled={true} originWhitelist={['*']} setSupportMultipleWindows={false} startInLoadingState={true} .... If you don't know a solution: Is there another service I can or should use for iPhones? What I want to achieve is: The app should start (automatically) in the language of the user (from device-locales) - on iPhone in the same way like on Android. BTW: I don't habe an iPhone and therefore can't test myself. I receive the messages from my users.
0
0
395
Jun ’26
Forcing a `WKWebsiteDataStore` proxy change onto existing connections without losing session state
Context: This is for a privacy relay in a browser, where the proxy is toggled on/off and rotated mid-session, so we can't lose the user's logged-in sessions when it engages. Connection pool behavior — is this expected? When we mutate proxyConfigurations on a live data store, the proxy only applies to newly-visited origins. Origins that already have established connections keep going direct — reloading the page, and even tearing down and recreating the WKWebView, doesn't move them onto the proxy. The only thing that reliably forces all traffic through the proxy is swapping in a brand-new WKWebsiteDataStore. Is that the intended behavior — i.e. is recreating the store the expected way to re-establish the connection pool — or is there a supported way to invalidate the existing connections so a mutated proxy config takes effect on already-loaded origins? What does fetchData / restoreData actually carry? To preserve the session across that store swap, we serialize the old store with fetchData(of: WKWebsiteDataStore.allWebsiteDataTypes()) and rehydrate the new one with restoreData(_:) (iOS 26). Passing the full allWebsiteDataTypes() set: Does this round-trip everything those types represent — cookies, localStorage, IndexedDB, service worker registrations, etc. — into a store created with init(forIdentifier:)? Does anything not enumerated by allWebsiteDataTypes() — per-site permissions, tracking-prevention/ITP state — get dropped silently?
Topic: Safari & Web SubTopic: WebKit
7
0
357
Jun ’26
Any way to avoid Content Security Policy violations for elements inserted by extensions?
Hi! It seems like in Safari, elements inserted into a page by web extensions (such as and elements) are currently subject to the page's Content Security Policy. If the CSP is strict enough, this prevents these elements from loading. Based on my testing, I've found that this behavior is different in other browsers, where a page's CSP is not applied to elements inserted by an extension. Is this expected behavior in Safari, or might it be considered a bug? Any advice on working around these restrictions, as it currently prevents my extension from working correctly on websites with a strict CSP?
2
0
218
Jun ’26
Network Extension behaviour with PAC
Hello, We have a Network extension transparent proxy (NETransparentProxyProvider) that receives browser TCP flows as NEAppProxyTCPFlow. For each flow we create an NWConnection to the flow's original destination and set NEParameters.preferNoProxies = true - expecting the outbound connection to bypass the user's HTTP/HTTPS proxy and PAC so it goes to the destination server directly. However, in practice we see connections still being redirected to local proxy after being evaluated against the PAC rules using the destination IP and port. Our questions are: Could we expect preferNoProxies to be respected when a PAC exist on the endpoint and supersede the PAC rule decision? If yes, what would be the best way to file a bug and what information do you need? If not, is there any other way of making sure that the outbound NWConnection created by the transparent proxy is not redirected to a proxy and goes directly to the destination? One other way of avoiding our NWConnection being redirected to the proxy is to use hostname instead of destination IP. Would there be a reliable way of getting hostname for the NEAppProxyTCPFlow so that PAC can correctly filter all NWConnection based on rules? We have explored remoteHostname but it's generally not available for connections from browsers other than Safari.
1
0
293
Jun ’26
Safari and Safari Technology Preview intermittently ignore clicks near bottom of webpage on macOS 27 Beta
Environment: MacBook Air M4 macOS 27 Beta Safari Safari Technology Preview Issue: I am experiencing an issue where mouse/trackpad clicks are intermittently ignored near the bottom portion of a webpage. The trackpad hardware appears to be functioning normally, as physical clicks are registered and the issue does not occur consistently across all browsers. Steps to Reproduce: Open Safari or Safari Technology Preview. Navigate to a webpage with interactive elements near the bottom of the visible page. Attempt to click links, buttons, or text fields located in approximately the bottom quarter of the browser window. Observe that clicks are sometimes not registered. Resize the Safari window so that the affected area is no longer located in the bottom portion of the screen. Attempt the same clicks again. Expected Result: Clicks should be consistently registered regardless of their position within the webpage. Actual Result: Clicks in the lower portion of the webpage are sometimes ignored. Resizing the window may temporarily resolve the issue. Additional Information: The trackpad itself appears to function normally. Physical clicks are detected. I have observed the issue in both Safari and Safari Technology Preview. I tested the same website in Perplexity Comet, where the issue does not appear to occur. This suggests the issue may be related to Safari’s rendering, hit-testing, event handling, or window management rather than the website itself. Has anyone else been able to reproduce this on macOS 27 Beta?
0
0
348
Jun ’26
Immersive AR mode of WebXR in visionOS Safari
After enabling WebXR following instructions from https://developer.apple.com/forums/thread/732629, I can successfully run WebXR, but it is limited to VR. I cannot get AR running. If I try await navigator.xr.isSessionSupported("immersive-ar"), the result is false. But if I try await navigator.xr.isSessionSupported("immersive-vr"), the result is true. I double checked that I specifically checked the box "WebXR Augmented Reality Module" in the Safari feature flags. Any idea how to enable WebXR AR mode? Thanks in advance!
2
3
1.8k
Jun ’26
VisionOS and WebXR
Has Apple worked out how WebXR authored projects in Safari operate with VisionOS? Quest has support already. And I imagine many cross platform experiences (especially for professional markets where the apps are on windows through web) would be serve well with this. Is there documentation for this?
4
2
1.5k
Jun ’26
Passing data buffers from web to Swift?
The new WKJSScriptingBuffer API allows Swift to define data buffers and make them available to JS code running in a WKWebView. Is there any API for passing an ArrayBuffer of data from a WKWebView to Swift code? Currently the usual workaround is to convert the buffer to a base64 string, but that is slow and can lead to exhausting memory depending on the size of the buffer. On the web, window.postMessage() has an argument that allows transferring ownership of ArrayBuffers to the receiver, but the webkit.messageHandlers.<name>.postMessage() API doesn't seem to support that.
Topic: Safari & Web SubTopic: WebKit
1
0
239
Jun ’26
How do I prevent javascript injection?
I build a framework that has a function that returns a UIView with a web view inside. The app that uses the framework has control over the webview through the subviews API of my UIView. I do not want the framework consumer to utilise the web view's methods and properties. How do I limit access to web view methods like evaluateJavascript, navigation delegate etc?
Topic: Safari & Web SubTopic: WebKit
1
0
229
Jun ’26
New document reader app deciding WebKit versus SwiftUI with a11y as tiebreaker
I'm working on a document reader for long form articles and I love what WebKit gives me for quickly delivering good looking content. But I'm hearing that accessibility support is stronger if I go with UIKit or SwiftUI. Accessibility support is meant to be a headline feature in my app so it's the deciding factor on which technology I should use (webview versus UIKit/SwiftUI). Given Accessibility Reader now provides system-wide reflow and spoken reading, is there now a durable reason a document reader developer should still invest in native UIKit/SwiftUI rendering rather than well-structured HTML in a webview? Where specifically does the system stop helping webview content? What I've heard is that webviews are disadvantaged on custom rotors, focus, and Dynamic Type fidelity. Is this accurate or has it changed this year? Bottom line, I'm wondering if WebKit is a compromise for a11y if I want not baseline accessibility, but truly leading unsurpassed accessibility.
Topic: Safari & Web SubTopic: General Tags:
0
0
310
Jun ’26
\Forcing a WKWebsiteDataStore proxy change onto existing connections without losing session state
Context: This is for a privacy relay in a browser, where the proxy is toggled on/off and rotated mid-session, so we can't lose the user's logged-in sessions when it engages. Connection pool behavior — is this expected? When we mutate proxyConfigurations on a live data store, the proxy only applies to newly-visited origins. Origins that already have established connections keep going direct — reloading the page, and even tearing down and recreating the WKWebView, doesn't move them onto the proxy. The only thing that reliably forces all traffic through the proxy is swapping in a brand-new WKWebsiteDataStore. Is that the intended behavior — i.e. is recreating the store the expected way to re-establish the connection pool — or is there a supported way to invalidate the existing connections so a mutated proxy config takes effect on already-loaded origins? What does fetchData/restoreData actually carry? To preserve the session across that store swap, we serialize the old store with fetchData(of: WKWebsiteDataStore.allWebsiteDataTypes()) and rehydrate the new one with restoreData(_:) (iOS 26). Passing the full allWebsiteDataTypes() set, does this round-trip everything those types represent — cookies, localStorage, IndexedDB, service worker registrations, etc. — into a store created with init(forIdentifier:)? And does anything not enumerated by allWebsiteDataTypes() — per-site permissions, tracking-prevention/ITP state — get dropped silently?
Topic: Safari & Web SubTopic: WebKit
2
0
242
Jun ’26
WebKit WKScreenTimeConfigurationObserver Crash in iOS26.2
Our app uses WKWebView to load web pages, and we're encountering a crash with WKScreenTimeConfigurationObserver on iOS 26.1 and above. However, there are no WKScreenTimeConfigurationObserver-related code calls in our project. The crash log is as follows: NSInternalInconsistencyException Cannot update for observer <WKScreenTimeConfigurationObserver 0x13be821e0> for the key path "configuration.enforcesChildRestrictions" from <STScreenTimeConfigurationObserver 0x13be808e0>, most likely because the value for the key "configuration" has changed without an appropriate KVO notification being sent. Check the KVO compliance of the STScreenTimeConfigurationObserver class. We want to confirm if this is a system bug. How can we fix it?
3
1
3.1k
Jun ’26
Safari iOS 17 layout issue
Safari on iOS 17, when entering characters into text input box after deleting characters, the layout is off. Here's the HTML: <body> <div id="J001" style="display: inline-block;"> <div id="J001__0" style="display: inline-block;"> <input id="J001__0__input" style="display: inline-block; height: 28px; padding:2px; border:1px solid gray;"></div> <div id="J003__0" style="display: inline-block;"> <button id="J003__0__btn" style="display: inline-block; height:34px;">a</button> </div> </div> </body> Enter "A" into text input box. Delete "A" with the backspace(x). Enter "A" into text input box, the button position will be shifted down. iOS 17 の Safari にて、テキスト入力ボックスで文字を削除した後、文字を入力するとレイアウトが崩れます。 テキスト入力ボックスに「A」と入力します。 バックスペース(x)で「A」を削除します。 テキスト入力ボックスに「A」と入力すると、ボタンの位置が下にずれます。
2
1
1.8k
Jun ’26
How to optimize a website for Siri voice search and Safari?
Hello everyone, I am testing how Siri interacts with web pages on iOS devices. When a user utilizes Siri voice commands to search for or open a specific website, Siri usually processes the request and opens the result inside the Safari browser. As a web developer, I want to know if there are any specific HTML meta tags, Schema markup, or SEO best practices that we should implement. This is to ensure Siri can accurately recognize the website's name, brand, and content. What are the simplest ways to make a static web page friendly for Siri voice search? Thanks in advance!
0
0
526
Jun ’26
(Air)Printing from JavaScript in Safari?
Is there any documentation or advice on printing from a Safari webapp (in JavaScript)? My app needs to print labels, and printing from Safari presents few options. For example, you can't turn off backgrounds or the URL/date/time footer. And it wants to print a full-size page, which ends up printing miles of label. (I've also tried printing from SwiftUI on a macOS app, and even that is just terrible to try to get right. Why is printing so hard?)
0
0
827
May ’26
Apple Pay Web: Multiple active PPCs for one Merchant ID?
Hi,
 We’re implementing Apple Pay on the Web for a multi-tenant platform via a PSP. The PSP operates multiple HSM/clusters and gave us multiple CSRs, asking us to register all.
Our understanding: a Merchant ID can hold several PPCs over time, but only one is active at once. Questions Is there any supported way to keep more than one PPC active simultaneously for the same Merchant ID? If not, what does Apple recommend for web-only, multi-tenant setups: a single MID with PSP-side decryption & sub-merchant separation, or separate MIDs per brand/region? Any official guidance on PPC rotation and handling many domains for Apple Pay on the Web? links to official docs or prior Apple responses would be appreciated.
Replies
2
Boosts
0
Views
1.3k
Activity
Jun ’26
Safari shows “Fraudulent Website Warning” for a clean domain. How to request re-evaluation?
Hello, Safari on iOS is showing a “Fraudulent Website Warning” for our domain: https://doobler.ru/ We are trying to understand how to properly diagnose this and request a re-evaluation. The website has a valid HTTPS certificate and does not currently appear to be flagged by the reputation tools we checked, including Google Safe Browsing / Search Console / VirusTotal. However, some iPhone users still see the Safari warning, while others do not. What we have checked so far: HTTPS certificate is valid No mixed-content or obvious redirect issues found Google Safe Browsing does not show the domain as unsafe Google Search Console does not show security issues VirusTotal does not show active malware/phishing detections The warning appears only for some users/devices We submitted a review request through Apple’s Website Review form, but have not received any response yet We would like to know: Is there any way to confirm whether the warning comes from Apple’s own reputation system, Google Safe Browsing, or another provider used by Safari? How long does Apple Website Review usually take for Safari fraudulent website warnings? Is there a recommended process for requesting re-evaluation if the warning appears to be a false positive? Are there specific technical signals Safari checks that we should verify, such as redirects, third-party scripts, domain reputation, or brand/phishing heuristics? This is affecting real users, so any guidance on the correct escalation or diagnostic path would be appreciated. Thank you.
Replies
0
Boosts
0
Views
336
Activity
Jun ’26
iOS 26 Safari & WebView: VisualViewport.offsetTop not reset after keyboard dismissal, causing fixed elements misplacement
1. System/device combinations where the issue does not occur: Physical device: iOS 26.0 (23A5318c) + iPhone 16 Pro Max 2. System/device combinations where the issue does occur: System versions: Physical device: iOS 26.0 (23A5330a), iOS 26.0 (23A340) Simulator: iOS 26.0 (23A339) Device models: Physical device: iPhone 12 Reproducible in Safari, WKWebView, and UIWebView: Yes Actual behavior In WebView (and identically in Safari): Before the keyboard is shown, header/footer elements with position: fixed are correctly aligned with the screen viewport. Scrolling up/down works as expected. After the keyboard appears, the visualViewport position changes. Bug: When the keyboard is dismissed, visualViewport.offsetTop does not reset to 0. As a result, fixed header/footer elements remain misaligned: When scrolling down, the position looks correct. When scrolling up, the header/footer are visibly offset. Steps to reproduce Focus an input field → the keyboard appears Dismiss the keyboard Observe that visualViewport.offsetTop remains >0 (does not reset to zero) position: fixed header/footer elements are misplaced relative to the screen Expected behavior After the keyboard is dismissed, visualViewport.height should return to match the layout viewport, and visualViewport.offsetTop should reset to 0. When scrolling upward, fixed elements should remain correctly positioned within the layout viewport. Minimal reproducible demo A simple HTML file containing: A header and footer with position: fixed An input element to trigger the keyboard <!DOCTYPE html> <html lang="zh-CN"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" /> <title>H5 吸顶吸底页面 Demo</title> <style> * { margin: 0; padding: 0; box-sizing: border-box; } body { font-family: Arial, sans-serif; height: 2000px; /* 设置内容高度 */ background-color: #f0f8ff; /* body 背景浅蓝色 */ padding-top: 120px; /* 预留 header 高度 */ padding-bottom: 60px; /* 预留 footer 高度 */ overflow-x: hidden; } /* 吸顶 Header */ header { position: fixed; top: 0; left: 0; width: 100%; height: 120px; background-color: #ff6b6b; /* 红色 */ display: flex; align-items: center; justify-content: center; color: white; font-size: 24px; font-weight: bold; z-index: 1000; } /* 吸底 Footer */ footer { position: fixed; bottom: 0; left: 0; width: 100%; height: 60px; background-color: #4ecdc4; /* 青绿色 */ display: flex; align-items: center; justify-content: center; color: white; font-size: 18px; font-weight: bold; z-index: 1000; } /* 输入框样式 */ .input-container { margin: 100px auto; width: 80%; max-width: 600px; text-align: center; } input[type='text'] { padding: 12px; font-size: 16px; border: 2px solid #ddd; border-radius: 8px; width: 100%; box-sizing: border-box; } input[type='text']:focus { outline: none; border-color: #4ecdc4; } </style> </head> <body> <!-- 吸顶 Header --> <header>吸顶 Header (120px)</header> <!-- 主体内容 --> <div class="input-container"> <input type="text" placeholder="请输入内容..." /> </div> <!-- 吸底 Footer --> <footer>吸底 Footer (60px)</footer> </body> </html>
Replies
28
Boosts
27
Views
24k
Activity
Jun ’26
Multilanguage in a WebView App on iPhone
I have a WebView App for my WordPress site. For multilanguage support I am using gTranslate. This works fine on any browser (also Safari) and also in my App on Android - but it does NOT work on iPhones. gTranslate is using GoogleTranslate. On iPhones it is kicked on correctly, but just does not translate the page. Do you have any clue why this is the case? What is hindering gTranslate (Google-Translate) to run on iPhones? My WebViews is starting with this - do I need something special for iOs?: <WebView style={{ flex: 1 }} ref={webViewRef} source={{ uri: initialUrl }} applicationNameForUserAgent={APP_AGENT} javaScriptEnabled={true} domStorageEnabled={true} sharedCookiesEnabled={true} cacheEnabled={false} thirdPartyCookiesEnabled={true} originWhitelist={['*']} setSupportMultipleWindows={false} startInLoadingState={true} .... If you don't know a solution: Is there another service I can or should use for iPhones? What I want to achieve is: The app should start (automatically) in the language of the user (from device-locales) - on iPhone in the same way like on Android. BTW: I don't habe an iPhone and therefore can't test myself. I receive the messages from my users.
Replies
0
Boosts
0
Views
395
Activity
Jun ’26
Forcing a `WKWebsiteDataStore` proxy change onto existing connections without losing session state
Context: This is for a privacy relay in a browser, where the proxy is toggled on/off and rotated mid-session, so we can't lose the user's logged-in sessions when it engages. Connection pool behavior — is this expected? When we mutate proxyConfigurations on a live data store, the proxy only applies to newly-visited origins. Origins that already have established connections keep going direct — reloading the page, and even tearing down and recreating the WKWebView, doesn't move them onto the proxy. The only thing that reliably forces all traffic through the proxy is swapping in a brand-new WKWebsiteDataStore. Is that the intended behavior — i.e. is recreating the store the expected way to re-establish the connection pool — or is there a supported way to invalidate the existing connections so a mutated proxy config takes effect on already-loaded origins? What does fetchData / restoreData actually carry? To preserve the session across that store swap, we serialize the old store with fetchData(of: WKWebsiteDataStore.allWebsiteDataTypes()) and rehydrate the new one with restoreData(_:) (iOS 26). Passing the full allWebsiteDataTypes() set: Does this round-trip everything those types represent — cookies, localStorage, IndexedDB, service worker registrations, etc. — into a store created with init(forIdentifier:)? Does anything not enumerated by allWebsiteDataTypes() — per-site permissions, tracking-prevention/ITP state — get dropped silently?
Topic: Safari & Web SubTopic: WebKit
Replies
7
Boosts
0
Views
357
Activity
Jun ’26
Any way to avoid Content Security Policy violations for elements inserted by extensions?
Hi! It seems like in Safari, elements inserted into a page by web extensions (such as and elements) are currently subject to the page's Content Security Policy. If the CSP is strict enough, this prevents these elements from loading. Based on my testing, I've found that this behavior is different in other browsers, where a page's CSP is not applied to elements inserted by an extension. Is this expected behavior in Safari, or might it be considered a bug? Any advice on working around these restrictions, as it currently prevents my extension from working correctly on websites with a strict CSP?
Replies
2
Boosts
0
Views
218
Activity
Jun ’26
Limiting user interaction when installing a Safari extension
Is there an MDM solution that will give a Safari extension all the permissions it needs with no interaction from the end user?
Replies
3
Boosts
1
Views
282
Activity
Jun ’26
Network Extension behaviour with PAC
Hello, We have a Network extension transparent proxy (NETransparentProxyProvider) that receives browser TCP flows as NEAppProxyTCPFlow. For each flow we create an NWConnection to the flow's original destination and set NEParameters.preferNoProxies = true - expecting the outbound connection to bypass the user's HTTP/HTTPS proxy and PAC so it goes to the destination server directly. However, in practice we see connections still being redirected to local proxy after being evaluated against the PAC rules using the destination IP and port. Our questions are: Could we expect preferNoProxies to be respected when a PAC exist on the endpoint and supersede the PAC rule decision? If yes, what would be the best way to file a bug and what information do you need? If not, is there any other way of making sure that the outbound NWConnection created by the transparent proxy is not redirected to a proxy and goes directly to the destination? One other way of avoiding our NWConnection being redirected to the proxy is to use hostname instead of destination IP. Would there be a reliable way of getting hostname for the NEAppProxyTCPFlow so that PAC can correctly filter all NWConnection based on rules? We have explored remoteHostname but it's generally not available for connections from browsers other than Safari.
Replies
1
Boosts
0
Views
293
Activity
Jun ’26
Safari and Safari Technology Preview intermittently ignore clicks near bottom of webpage on macOS 27 Beta
Environment: MacBook Air M4 macOS 27 Beta Safari Safari Technology Preview Issue: I am experiencing an issue where mouse/trackpad clicks are intermittently ignored near the bottom portion of a webpage. The trackpad hardware appears to be functioning normally, as physical clicks are registered and the issue does not occur consistently across all browsers. Steps to Reproduce: Open Safari or Safari Technology Preview. Navigate to a webpage with interactive elements near the bottom of the visible page. Attempt to click links, buttons, or text fields located in approximately the bottom quarter of the browser window. Observe that clicks are sometimes not registered. Resize the Safari window so that the affected area is no longer located in the bottom portion of the screen. Attempt the same clicks again. Expected Result: Clicks should be consistently registered regardless of their position within the webpage. Actual Result: Clicks in the lower portion of the webpage are sometimes ignored. Resizing the window may temporarily resolve the issue. Additional Information: The trackpad itself appears to function normally. Physical clicks are detected. I have observed the issue in both Safari and Safari Technology Preview. I tested the same website in Perplexity Comet, where the issue does not appear to occur. This suggests the issue may be related to Safari’s rendering, hit-testing, event handling, or window management rather than the website itself. Has anyone else been able to reproduce this on macOS 27 Beta?
Replies
0
Boosts
0
Views
348
Activity
Jun ’26
Immersive AR mode of WebXR in visionOS Safari
After enabling WebXR following instructions from https://developer.apple.com/forums/thread/732629, I can successfully run WebXR, but it is limited to VR. I cannot get AR running. If I try await navigator.xr.isSessionSupported("immersive-ar"), the result is false. But if I try await navigator.xr.isSessionSupported("immersive-vr"), the result is true. I double checked that I specifically checked the box "WebXR Augmented Reality Module" in the Safari feature flags. Any idea how to enable WebXR AR mode? Thanks in advance!
Replies
2
Boosts
3
Views
1.8k
Activity
Jun ’26
VisionOS and WebXR
Has Apple worked out how WebXR authored projects in Safari operate with VisionOS? Quest has support already. And I imagine many cross platform experiences (especially for professional markets where the apps are on windows through web) would be serve well with this. Is there documentation for this?
Replies
4
Boosts
2
Views
1.5k
Activity
Jun ’26
Is there a way to get password autofill on a WebView?
Hi, I see that on WebViews we don't get the same interface for allowing the user to use a saved password or passkey as in Safari or on an Authentication View. Can the same be accomplished on a WebView?
Topic: Safari & Web SubTopic: WebKit
Replies
1
Boosts
1
Views
261
Activity
Jun ’26
Passing data buffers from web to Swift?
The new WKJSScriptingBuffer API allows Swift to define data buffers and make them available to JS code running in a WKWebView. Is there any API for passing an ArrayBuffer of data from a WKWebView to Swift code? Currently the usual workaround is to convert the buffer to a base64 string, but that is slow and can lead to exhausting memory depending on the size of the buffer. On the web, window.postMessage() has an argument that allows transferring ownership of ArrayBuffers to the receiver, but the webkit.messageHandlers.<name>.postMessage() API doesn't seem to support that.
Topic: Safari & Web SubTopic: WebKit
Replies
1
Boosts
0
Views
239
Activity
Jun ’26
How do I prevent javascript injection?
I build a framework that has a function that returns a UIView with a web view inside. The app that uses the framework has control over the webview through the subviews API of my UIView. I do not want the framework consumer to utilise the web view's methods and properties. How do I limit access to web view methods like evaluateJavascript, navigation delegate etc?
Topic: Safari & Web SubTopic: WebKit
Replies
1
Boosts
0
Views
229
Activity
Jun ’26
New document reader app deciding WebKit versus SwiftUI with a11y as tiebreaker
I'm working on a document reader for long form articles and I love what WebKit gives me for quickly delivering good looking content. But I'm hearing that accessibility support is stronger if I go with UIKit or SwiftUI. Accessibility support is meant to be a headline feature in my app so it's the deciding factor on which technology I should use (webview versus UIKit/SwiftUI). Given Accessibility Reader now provides system-wide reflow and spoken reading, is there now a durable reason a document reader developer should still invest in native UIKit/SwiftUI rendering rather than well-structured HTML in a webview? Where specifically does the system stop helping webview content? What I've heard is that webviews are disadvantaged on custom rotors, focus, and Dynamic Type fidelity. Is this accurate or has it changed this year? Bottom line, I'm wondering if WebKit is a compromise for a11y if I want not baseline accessibility, but truly leading unsurpassed accessibility.
Topic: Safari & Web SubTopic: General Tags:
Replies
0
Boosts
0
Views
310
Activity
Jun ’26
\Forcing a WKWebsiteDataStore proxy change onto existing connections without losing session state
Context: This is for a privacy relay in a browser, where the proxy is toggled on/off and rotated mid-session, so we can't lose the user's logged-in sessions when it engages. Connection pool behavior — is this expected? When we mutate proxyConfigurations on a live data store, the proxy only applies to newly-visited origins. Origins that already have established connections keep going direct — reloading the page, and even tearing down and recreating the WKWebView, doesn't move them onto the proxy. The only thing that reliably forces all traffic through the proxy is swapping in a brand-new WKWebsiteDataStore. Is that the intended behavior — i.e. is recreating the store the expected way to re-establish the connection pool — or is there a supported way to invalidate the existing connections so a mutated proxy config takes effect on already-loaded origins? What does fetchData/restoreData actually carry? To preserve the session across that store swap, we serialize the old store with fetchData(of: WKWebsiteDataStore.allWebsiteDataTypes()) and rehydrate the new one with restoreData(_:) (iOS 26). Passing the full allWebsiteDataTypes() set, does this round-trip everything those types represent — cookies, localStorage, IndexedDB, service worker registrations, etc. — into a store created with init(forIdentifier:)? And does anything not enumerated by allWebsiteDataTypes() — per-site permissions, tracking-prevention/ITP state — get dropped silently?
Topic: Safari & Web SubTopic: WebKit
Replies
2
Boosts
0
Views
242
Activity
Jun ’26
WebKit WKScreenTimeConfigurationObserver Crash in iOS26.2
Our app uses WKWebView to load web pages, and we're encountering a crash with WKScreenTimeConfigurationObserver on iOS 26.1 and above. However, there are no WKScreenTimeConfigurationObserver-related code calls in our project. The crash log is as follows: NSInternalInconsistencyException Cannot update for observer <WKScreenTimeConfigurationObserver 0x13be821e0> for the key path "configuration.enforcesChildRestrictions" from <STScreenTimeConfigurationObserver 0x13be808e0>, most likely because the value for the key "configuration" has changed without an appropriate KVO notification being sent. Check the KVO compliance of the STScreenTimeConfigurationObserver class. We want to confirm if this is a system bug. How can we fix it?
Replies
3
Boosts
1
Views
3.1k
Activity
Jun ’26
Safari iOS 17 layout issue
Safari on iOS 17, when entering characters into text input box after deleting characters, the layout is off. Here's the HTML: <body> <div id="J001" style="display: inline-block;"> <div id="J001__0" style="display: inline-block;"> <input id="J001__0__input" style="display: inline-block; height: 28px; padding:2px; border:1px solid gray;"></div> <div id="J003__0" style="display: inline-block;"> <button id="J003__0__btn" style="display: inline-block; height:34px;">a</button> </div> </div> </body> Enter "A" into text input box. Delete "A" with the backspace(x). Enter "A" into text input box, the button position will be shifted down. iOS 17 の Safari にて、テキスト入力ボックスで文字を削除した後、文字を入力するとレイアウトが崩れます。 テキスト入力ボックスに「A」と入力します。 バックスペース(x)で「A」を削除します。 テキスト入力ボックスに「A」と入力すると、ボタンの位置が下にずれます。
Replies
2
Boosts
1
Views
1.8k
Activity
Jun ’26
How to optimize a website for Siri voice search and Safari?
Hello everyone, I am testing how Siri interacts with web pages on iOS devices. When a user utilizes Siri voice commands to search for or open a specific website, Siri usually processes the request and opens the result inside the Safari browser. As a web developer, I want to know if there are any specific HTML meta tags, Schema markup, or SEO best practices that we should implement. This is to ensure Siri can accurately recognize the website's name, brand, and content. What are the simplest ways to make a static web page friendly for Siri voice search? Thanks in advance!
Replies
0
Boosts
0
Views
526
Activity
Jun ’26
(Air)Printing from JavaScript in Safari?
Is there any documentation or advice on printing from a Safari webapp (in JavaScript)? My app needs to print labels, and printing from Safari presents few options. For example, you can't turn off backgrounds or the URL/date/time footer. And it wants to print a full-size page, which ends up printing miles of label. (I've also tried printing from SwiftUI on a macOS app, and even that is just terrible to try to get right. Why is printing so hard?)
Replies
0
Boosts
0
Views
827
Activity
May ’26