Trying to implement my own forward/back buttons for the new SwiftUI WebView and reading the documentation I’m totally lost.
What’s the recommended way of implementing forward/back behavior with this component?
General
RSS for tagExplore the integration of web technologies within your app. Discuss building web-based apps, leveraging Safari functionalities, and integrating with web services.
Selecting any option will automatically load the page
Post
Replies
Boosts
Views
Activity
When attempting to authorize an Apple Payment on an iOS 18 device using the scannable code in a non-Safari browser (i.e. Chrome), the payment sheet displays briefly, then dismisses.
This same exact implementation of Apple Pay on the Web works flawlessly in Safari, so this feels like a bug given that the merchant session works fine in Safari.
The following errors were found in my iOS device logs:
(PassbookUIService) Codable: Failed to decode Merchant Session Created: Error Domain=NSCocoaErrorDomain Code=4864 UserInfo={NSDebugDescription=<private>, NSCodingPath=<private>}
(PassbookUIService) Session 29592: Fatal Error: Failed to decode merchant session created`
I am trying to setup web sign in with apple, I have an active apple subscription and have set up all necessary things. I made a service id in apple Identifiers, connected to existing primary id (also has apple sign in enabled). I have my domain set up also correctly but still I cant generate the code due to invalid client. What do I need to do?
I have also tried recreating the service ids multiple times with no luck.
my init is
AppleID.auth.init({
clientId : '[CLIENT_ID]',//used the service id one not app id
redirectURI : '[REDIRECT_URI]',
usePopup : true
});
link to generate codes now is: https://appleid.apple.com/auth/authorize?client_id=com.crmtournest.sigin&redirect_uri=https%3A%2F%2Fwww.tournestcrm.com%2Fauth%2Fcallback&response_type=code%20id_token&state=saciy7rn1km&scope=name%20email&response_mode=web_message&frame_id=03487c22-abb4-48cd-8613-d6bf5836e9eb&m=11&v=1.5.5
Also tried: https://appleid.apple.com/auth/authorize?client_id=com.crmtournest.sigin&redirect_uri=https%3A%2F%2Fwww.tournestcrm.com%2Fauth%2Fcallback&response_type=code%20id_token (not working)
I get invalid_client
setup on apple below:
Hi, We are facing a major issue with our application. We are using FolioReaderkit to read epub files. Currently, it's working on the iOS 18.1 device and simulator, but it's not working on the iOS 18.2 and later version devices.
we are facing this error in Folioreaderkit
From a mail app or similar, when opening a webpage in Safari as an external browser, JavaScript on the webpage stops running if Safari goes into the background. Is there a way to prevent this from happening?
Sample code for the counter:
Behavior: Upon returning from the background, the counter continues for about 7-8 seconds but does not progress further.
For example, if Safari is kept in the background for about 20 seconds and then brought back, the counter stops at around 7-8 seconds and only resumes counting after returning to the foreground.
Expectation: The counter should continue running even if Safari goes into the background.
I am posting here because we have an urgent issue affecting the operation of our service and are in need of a solution after our own analysis has come up with few answers.
Beginning in iOS 18.2.x, we experienced exactly the same issue as the author of this thread, as we are also operating a service that allows for device certificate login for users configured to require one:
https://developer.apple.com/forums/thread/767374
The author seems to have resolved the issue but the fix mentioned in the thread did not resolve our problem for iOS devices with iOS 18.2.x installed and the contents of that private support ticket are, of course, not visible to us. Furthermore, we have a different issue that surfaced with the release of iOS 18.3.x.
Namely, the issue in iOS 18.3.x is more severe than the one in iOS 18.2.x, in that instead of simply taking a long time for the certificate/identity selection dialog to appear, it simply fails immediately and is returning a “no certificate selected” response to our server.
One thing to note here is that, curiously, if we wait for several seconds (about 10-15 seconds) this behavior is not replicated. So, it seems there is potentially something going in the background, and the certificate selection process will only occur successfully like before if we wait. This is a very unideal workaround.
After entering user credentials, we have the user navigate to a dedicated certificate authentication page. On the BIG IP side, upon users visiting this page, we have it configured to apply an SSL profile that contains appropriate CAs for the given user, and then requests to the browser that a new connection requiring a certificate be made.
We are investigating this by checking logs in in a variety of places:
We can verify in BigIP logs that a response is being returned to the server without a certificate included. For the sake of our application, this is handled as a “user did not select a certificate” event, and thus the attempted login is failed. Using the MacOS “Console” application, we are able to see the following logs from the “trustd” process of the target iOS 18.3.x device:
Failure case:
debug 11:19:49.648581+0900 trustd XPC [com.apple.WebKit[1034]/1#25 LF=0] operation: trust_evaluate (8)
debug 11:19:49.648766+0900 trustd complex trust settings anchor
Successful case (after waiting 10-15 seconds after initial login page load/before moving to certificate page):
debug 11:26:02.803153+0900 trustd XPC [MobileSafari[1031]/1#169 LF=0] operation: trust_evaluate (8)
debug 11:26:02.804219+0900 trustd non ev score: 121 <private>
There appears to be no attempt by MobileSafari to initiate the display of a certificate selection window in the failure cases. The iOS device is swift to return a response with no certificate selected to Big IP, and the result of “no certificate selected” is thus propagated through Big IP and ultimately to our web service.
Does anyone have any advice or information on the following?
Recommended tools to gather more data that may be pertinent.
Any ideas on changes in iOS 18.2.x+ that could have resulted in the behavior changing as described above?
If more information is necessary, I will do my best to supply it. Thank you in advance!
Topic:
Safari & Web
SubTopic:
General
Hello, my application experiences crashes related to JavaScriptCore in iOS 17 and 18. I would like to consult about potential causes, to determine whether it is a bug in JavaScriptCore or an issue with my code implementation.
First, the crash stack always includes the call to
JSC::MarkedBlock::aboutToMarkSlow(unsigned int).
In the iOS 17 version, the crash occurs on this line, typically
JSC::MarkedBlock::aboutToMarkSlow(unsigned int) + 88.
In iOS 18 and later, the stack crashes atJSC::MarkedBlock::dumpInfoAndCrashForInvalidHandle(WTF::AbstractLocker&, JSC::HeapCell*).
I checked the source code of JavaScriptCore for both iOS 17.6 and iOS 18.2 and observed modifications in the implementation of aboutToMarkSlow.
My question is under what circumstances could this crash occur?
crash.log
I have attached a crash log encountered in iOS 18, hoping you can provide more effective information for problem diagnosis, especially since there are specific details worth noting near the crash registers.
INVALID HANDLE: MarkedBlock = 0x141158000; heapCell = 0x14115bfa0; type = 0
INVALID HANDLE: found 24 0s at beginning of block
INVALID HANDLE: block in another VM: 1, block in another VM: 1; other VM is 0x1324b6000
Moreover, in iOS 18.4, due to the implementation of dumpInfoAndCrashForInvalidHandleV2, the message has changed to:
INVALID HANDLE 587: markedBlock=0x303518000; heapCell=0x303518fe0; cellFirst8Bytes=0; subspaceHash=0; contiguousZeros=0; totalzeros=0; blockVM=0x0; actualVM=0x0;
isBlockVMValid=0; isBlockInSet=0; isBlockInDir=0; foundInBlockVM=0;
INVALID HANDLE 606: markedBlock=0x303518000; heapCell=0x303518fe0; cellFirst8Bytes=0; subspaceHash=0; contiguousZeros=16384; totalZeros=16384; blockVM=0x0; actualVM=0x0;
isBlockVMValid=0; isBlockInSet=0; isBlockInDir=0; foundInBlockVM=0;
INVALID HANDLE 615: markedBlock=0x303518000; heapCell=0x303518fe0; cellFirst8Bytes=0; subspaceHash=0; contiguousZeros=16384; totalZeros=16384; blockVM=0x0; actualVM=0x0;
isBlockVMValid=0; isBlockInSet=1; isBlockInDir=1; foundInBlockVM=0;
(Further INVALID HANDLE messages follow the same format)
I hope this provides you with more information.
This is a rare occurrence on our site, having only detected 4 instances of it over the past few weeks, where 10s of thousands of transactions have occurred successfully.
We only call the following PaymentRequest API onClick from the <apple-pay-button>:
async function startApplePay(merchantIdentifier, amount) {
...
try {
const request = new PaymentRequest([ applePayMethod ], paymentDetails);
...
catch (e) {
// cancel, just stay here
if (e.name === "AbortError") {
if (consoleLog) console.log("Payment canceled", e);
logServer("INFO", "Payment canceled");
}
else {
handleError("Error caught: " + e.name + ", " + e.cause + ", " + e.message);
}
}
Where the "handleError" else case is what gets triggered:
Error caught: SecurityError, undefined, show() must be triggered by user activation.
All 4 instances have been from iPads, but with that small of a sample size, we can't tell whether that's relevant or coincidence. Different iOS versions, but looks like same Safari version.
Here are the 4 User Agents we've seen thus far:
Mozilla/5.0 (iPad; CPU OS 18_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/352.0.715618234 Mobile/15E148 Safari/604.1
Mozilla/5.0 (iPad; CPU OS 17_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/352.0.715618234 Mobile/15E148 Safari/604.1
Mozilla/5.0 (iPad; CPU OS 18_3_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/133.0.6943.33 Mobile/15E148 Safari/604.1
Mozilla/5.0 (iPad; CPU OS 18_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/133.0.6943.33 Mobile/15E148 Safari/604.1
iPadOS 26, dark mode
Open Safari
Search for anything or open a website that has white background
Kill Safari
Open Safari again
I still can reproduce it with Safari on iPadOS 26.0.1
This issue also happens to my app when opening a HTML/JS on WKWebView with white background while using dark mode. I did send a feedback ticket when using iPadOS 26 beta but havent seen any reply. This is my first time sending a feedback so I dont know if Apple would reply or not.
I’m experiencing a crash in WKWebView on iOS 26 Developer Beta 5 and Beta 6 with the following exception:
CALayer position contains NaN: [nan 65]
The crash occurs when the following CSS properties are applied to content displayed in WKWebView:
-webkit-user-select: none;
-webkit-touch-callout: none;
This issue happens consistently whenever these styles are set, leading to the crash inside WKWebView.
Is this a known bug in the current iOS 26 betas, or is there a recommended workaround?
使用direct distribution进行分发时,safari web extension 在safari setting 中显示没有权限读取、修改或传输任何网页的内容。
但是我在看公证日志显示插件是正常的公证的
这导致safari extension 无法使用。
公证日志
https://www.coupert.com/img/2025-04-10/notarization-log.json
Safari 18.0.1 on macOS 15.01 doesn't support the Passkey PRF extension during cross-device WebAuthn authentication when using QR code scanning, while it works correctly with iCloud passkeys.
Steps to Reproduce:
Clone and setup:
git clone https://github.com/quocle108/passkey-prf-test
yarn
yarn start
Test iCloud Passkey Flow:
Open http://localhost:3000 in Safari
Open DevTools (Cmd+Option+I)
Click "Register"
Choose "Passkey on iCloud"
Expected console output: PRF supported: true
Test Cross-Device Flow:
Click "Register"
Choose "Phone/Tablet"
Scan QR with mobile device
Expected: PRF supported: true
PRF extension should be supported in cross-device flow, matching iCloud passkey behavior.
Actual: PRF supported: false
Cross-device flow returns empty extension results.
Verify in Chrome
Repeat steps 2-3 in Chrome
Both flows return proper PRF extension results: PRF supported: true
Test Environment:
Browser: Safari 18.1.1 , Chrome 131.0.6778.70
OS: macOS 15.01
Mobile: iOS 18.x / Galaxy Note9 Android 10
Test repo: https://github.com/quocle108/passkey-prf-test
I am encountering an intermittent issue with WKWebView in my iOS app. The problem occurs infrequently, but when it does, the WKWebView consistently displays a white screen and remains in this state until the app is forcefully terminated and relaunched.
To provide more context, here are the key characteristics of the issue:
The white screen problem occurs sporadically and is not easily reproducible.
The WKWebView remains unresponsive despite attempts to interact with it.
Reloading the webpage or navigating to a different URL does not resolve the white screen issue.
The problem persists until the app is terminated and relaunched.
This issue is specific to the WKWebView; other components of the app function correctly.
The WKWebView renders normally, and the main document synchronously loads resources both offline and online without any issues. The bridge and JavaScript execution also work as expected.
However, when interacting with the WKWebView, it becomes unresponsive to user clicks, and the web inspector fails to respond. Additionally, asynchronous network requests also do not receive any response.
The problem occurs exclusively on HTTPS pages, whereas HTTP pages load without any issues. Other components, such as workers, function correctly.
addUserScript injection during WKWebView creation is effective, and evaluateJavaScript during the page loading process works as expected. However, when the document becomes unresponsive, executing evaluateJavaScript only triggers the callback after the WKWebView is destroyed.
I have discovered a reliable method to reproduce the white screen issue in WKWebView. This method involves the following steps and conditions:
Create a WKWebView instance.
Load an HTML page using the loadRequest method(https url request).
Before the WKWebView is attached to the UI (not yet visible to the user), call the evaluateJavaScript function.
This issue has occurred in almost all iOS versions, including the latest iOS 17.x version.
Since iOS 18.1 launched as a beta, we've been getting reports from end users on iPhone 15 Pro and iPhone 15 Pro Max specifically. They're reporting that our WebView is unable to load our local HTML content. I'm curious if anyone else has had their app or users run into this issue?
So far I've tried installing the most recent XCode Beta 16B5014f and installed an 18.1 emulator, but our app worked fine. It's also working fine on all my real devices, but we don't have a 15 Pro to test on. I'm curious if this is related to the processor on these devices and how they are intended to support Apple's new AI coming in 18.1.
Subject: Unexpected system confirmation dialog when opening a Universal Link
Description of the issue:
We’re implementing a login flow using Native iOS apps, Universal Links, and OpenID Connect authentication. Our domain is correctly configured with the apple-app-site-association file, and Universal Links work as expected.
However, under certain circumstances, the behavior differs on the same login page:
The user connects to the OIDC provider in their mobile browser.
Instead of automatically switching to the Native application, a popup asks the user to open the app.
The behavior depends on how the login page is opened:
When opened in a new browser tab, the Universal Link opens the app immediately without showing any system confirmation dialog.
When the same tab is reused without a page refresh, iOS displays a system confirmation dialog asking the user to open the link in the app. This confirmation dialog doesn’t appear in the first scenario.
This additional system dialog impacts the user experience, as we aim for a frictionless and seamless login flow with minimal confirmation steps.
Question: Why does the app switch work automatically only the first time?
Is this intentional iOS behavior? If so, what security requirement or system rule causes a confirmation dialog when reusing the same tab, but not when redirecting in a new tab or pressing a button on the reused tab? Is this expected design, or should we adjust our side to avoid this dialog?
Environment details:
Verified on two devices
iOS versions: 18.7.2, 26.1
Thanks for your help.
I'm a web developer of WebRTC based web app for video and audio calls. After updating to iOS 26.1 beta I noticed, that my app can't use microphone anymore.
When I'm calling to getUserMedia with audio set to true, Safari returns error "No AVAudioSessionCaptureDevice device".
Other WebRTC demo apps also can't access microphone on this firmware.
And maybe it's connected somehow, but safari can't detect connected AirPods Pro 2 as an input device.
So, this bug brakes any WebRTC app, that uses microphones.
Hi all,
I'm currently working with WKWebView and implementing the WKNavigationDelegate protocol. In particular, I'm trying to inspect the sourceFrame of a WKNavigationAction to make navigation policy decisions based on the frame's URL path.
Here's the relevant Swift code inside decidePolicyFor:
public func webView(_ webView: WKWebView, decidePolicyFor navigationAction: WKNavigationAction, preferences: WKWebpagePreferences, decisionHandler: @escaping (WKNavigationActionPolicy, WKWebpagePreferences) -> Void) {
// ...
let sourceFrame: WKFrameInfo = navigationAction.sourceFrame
let request: URLRequest = sourceFrame.request // <- SIGABRT occurs here
// ...
}
The issue is that the app crashes with a SIGABRT at runtime when attempting to access sourceFrame.request. According to Swift's type system, neither sourceFrame nor its request property are optional, so at first glance this seems safe. However, the crash report suggests otherwise.
From the crash log, it appears that the issue arises during the bridging from Objective-C to Swift:
Thread 1 Queue : com.apple.main-thread (serial)
#0 0x00000001a127a030 in static Foundation.URLRequest._unconditionallyBridgeFromObjectiveC(Swift.Optional<__C.NSURLRequest>) -> Foundation.URLRequest ()
#1 0x00000001056c48b0 in CustomWebViewController.webView(_:decidePolicyFor:preferences:decisionHandler:)
#2 0x00000001056c4c78 in @objc CustomWebViewController.webView(_:decidePolicyFor:preferences:decisionHandler:) ()
#3 0x00000001b8c66e0c in WebKit::NavigationState::NavigationClient::decidePolicyForNavigationAction ()
#4 0x00000001b8fd14dc in WebKit::WebPageProxy::decidePolicyForNavigationAction ()
#5 0x00000001b8fcfc7c in WebKit::WebPageProxy::decidePolicyForNavigationActionAsyncShared ()
#6 0x00000001b8fcfb18 in WebKit::WebPageProxy::decidePolicyForNavigationActionAsync ()
#7 0x00000001b87ddaa0 in WebKit::WebPageProxy::didReceiveMessage ()
#8 0x00000001b869f474 in IPC::MessageReceiverMap::dispatchMessage ()
#9 0x00000001b878dda4 in WebKit::WebProcessProxy::dispatchMessage ()
#10 0x00000001b878d614 in WebKit::WebProcessProxy::didReceiveMessage ()
#11 0x00000001b869e7e4 in IPC::Connection::dispatchMessage ()
#12 0x00000001b869e358 in IPC::Connection::dispatchIncomingMessages ()
#13 0x00000001b9a96a44 in WTF::RunLoop::performWork ()
#14 0x00000001b9a96688 in WTF::RunLoop::performWork ()
#15 0x00000001a2428b9c in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ ()
#16 0x00000001a24289b4 in __CFRunLoopDoSource0 ()
#17 0x00000001a2428810 in __CFRunLoopDoSources0 ()
#18 0x00000001a2429190 in __CFRunLoopRun ()
#19 0x00000001a242ad4c in CFRunLoopRunSpecific ()
#20 0x00000001ef705454 in GSEventRunModal ()
#21 0x00000001a4e45890 in -[UIApplication _run] ()
#22 0x00000001a4e10cec in UIApplicationMain ()
#23 0x00000001a4ef261c in ___lldb_unnamed_symbol275689 ()
#24 0x00000001059a5104 in static UIApplicationDelegate.main() ()
#25 0x00000001059a5074 in static AppDelegate.$main() ()
#26 0x00000001059a82ec in main ()
#27 0x00000001c940af0c in start ()
This implies that while Swift treats sourceFrame.request as non-optional, the underlying Objective-C implementation may actually return nil—leading to a crash when the non-optional Swift type attempts to force unwrap it.
My question:
Is there a way to safely access navigationAction.sourceFrame.request —- or determine if it’s nil—before Swift attempts the implicit bridging from Objective-C? Or is there an established workaround for safely inspecting this property?
Any guidance or best practices for avoiding this crash would be greatly appreciated!
Thanks in advance.
Sometimes Safari is rendering the icon for an active extension in its original provided colored representation, other times Safari is applying an overlay color in line with the system's highlight color.
This difference can even be seen seen on the Safari Extensions Developer home page: https://developer.apple.com/safari/extensions/images/extensions-hero-large_2x.png
You will notice that Grammarly's icon is shown in it's original color format, while the others aren't.
Example of extensions where the icon is shown in color:
Bitwarden
Grammarly
1Password
Consent-O-Matic
I've compared the source code of Bitwarden and Consent-o-Matic with my own extension and cannot find any differences in the settings or image properties (resolution, DPI, file type, color profile). If I take the exact PNG source files from said open source extensions and replace them in my own source code, these icons show up in full color.
Does this perhaps mean there is a bug in Safari's processing of the icons where it fails to overlay the icon with the highlight color in some cases?
I and I assume many developers with me would like to understand what determines this difference. Ideally, there is a consistent UX where the end user has the choice between icons in color or highlight color overlay.
I am encountering an issue where we are unable to run or launch Safari Driver in our automation tests using macOS. When attempting to run safaridriver -p 8888 from the terminal, we receive the following error message:
ERROR: safaridriver could not launch because it is not configured correctly or you need to authenticate. Re-run safaridriver(1) and pass the '--enable' flag to configure and/or authenticate.
For more information, consult the safaridriver(1) man page.
Despite running sudo safaridriver --enable as an administrator (even as root), the issue persists.
I’ve searched through various online forums and GitHub repositories but couldn’t find a working solution. Some references are:
Apple Developer Forum Thread: https://forums.developer.apple.com/forums/thread/762321
GitHub Issue: https://github.com/SeleniumHQ/selenium/issues/11381
Hi,
I have an app that uses WKWebView and it's crashing on iOS 26 Simulator in places I've never had problems before. In this case it's crashing when calling WKWebView.callAsyncJavaScript, but in my other project WKWebView is crashing with some sort of EXC_BAD_ACCESS other than callAsyncJavaScript.
Am I missing something?
Thanks,
Topic:
Safari & Web
SubTopic:
General