You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@cordova.apache.org by "miagi-anhph (via GitHub)" <gi...@apache.org> on 2026/05/28 10:00:46 UTC
[I] CORS error with app://localhost origin in cordova-ios 8 — WKWebView ignores scheme preference "https", falls back to "app" [cordova-ios]
miagi-anhph opened a new issue, #1658:
URL: https://github.com/apache/cordova-ios/issues/1658
# Bug Report
## Problem
### What is expected to happen?
When `<preference name="scheme" value="https" />` is set in `config.xml`, WKWebView should use `https://localhost` as the origin, allowing CORS requests to external APIs to work as they did in cordova-ios 7.
### What does actually happen?
cordova-ios 8 ignores the `scheme` preference when set to `https` because `CDVWebViewEngine.m` checks `[WKWebView handlesURLScheme:scheme]` — which returns `YES` for `https` — and falls back to `app://localhost`.
This causes all XHR/fetch requests to external APIs to fail with:
```
Failed to load resource: Origin app://localhost is not allowed by Access-Control-Allow-Origin. Status code: 204
```
The app is stuck on the splash screen because the initial API call fails due to CORS rejection.
The relevant code in `CDVWebViewEngine.m` (line ~181):
```objc
if(scheme == nil || [WKWebView handlesURLScheme:scheme]){
scheme = @"app";
self.viewController.appScheme = scheme;
}
```
This means there is **no way** to set a scheme that external servers will accept via CORS, since:
- `https` is rejected by WKWebView (already handled internally, cannot register custom URLSchemeHandler — causes crash)
- `app` is a custom scheme that most servers don't include in `Access-Control-Allow-Origin`
- Any other custom scheme (e.g. `ionic`) has the same CORS problem as `app`
I also tried applying the fix from [#1632](https://github.com/apache/cordova-ios/pull/1632/files) (re-adding the deprecated `shouldOverrideLoadWithRequest:navigationType:` selector), but it was already present in cordova-ios 8.0.1 and does not resolve the CORS issue.
## Information
### Command or Code
`config.xml`:
```xml
<preference name="scheme" value="https" />
<preference name="hostname" value="localhost" />
```
API calls are made via jQuery `$.ajax` (XMLHttpRequest) to external HTTPS endpoints. All requests fail at the CORS preflight stage (OPTIONS returns 204 but rejects `Origin: app://localhost`).
### Environment, Platform, Device
- Device: iPhone SE 2nd gen (iPhone12,8), iOS 18.7.9
- macOS: 15.7.5
- Xcode: 26.2 (Build 17C52)
### Version information
- Cordova CLI: latest
- cordova-ios: 8.0.1
- cordova-plugin-inappbrowser, cordova-plugin-fcm-with-dependecy-updated, and other standard plugins
- jQuery 3.6.0, AngularJS 1.7.8 (for HTTP calls)
## Checklist
- [x] I searched for existing GitHub issues
- [x] I updated all Cordova tooling to most recent version
- [x] I included all the necessary information above
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
Re: [I] CORS error with app://localhost origin in cordova-ios 8 — WKWebView ignores scheme preference "https", falls back to "app" [cordova-ios]
Posted by "dpogue (via GitHub)" <gi...@apache.org>.
dpogue commented on issue #1658:
URL: https://github.com/apache/cordova-ios/issues/1658#issuecomment-4566365463
It has always been the case (even in the `UIWebView` and `file:///` days) that web servers need to modify their CORS responses to explicitly allow the Cordova web view to make requests.
As erisu mentions, WKWebView doesn't allow using `https` as a custom scheme, so there is nothing Cordova can do here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
Re: [I] CORS error with app://localhost origin in cordova-ios 8 — WKWebView ignores scheme preference "https", falls back to "app" [cordova-ios]
Posted by "dpogue (via GitHub)" <gi...@apache.org>.
dpogue closed issue #1658: CORS error with app://localhost origin in cordova-ios 8 — WKWebView ignores scheme preference "https", falls back to "app"
URL: https://github.com/apache/cordova-ios/issues/1658
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
Re: [I] CORS error with app://localhost origin in cordova-ios 8 — WKWebView ignores scheme preference "https", falls back to "app" [cordova-ios]
Posted by "erisu (via GitHub)" <gi...@apache.org>.
erisu commented on issue #1658:
URL: https://github.com/apache/cordova-ios/issues/1658#issuecomment-4563357987
I don't believe this is possible using `WKURLSchemeHandler`.
`WKURLSchemeHandler` can only register custom URL schemes. WebKit does not allow apps to register built-in reserved schemes such as `http` or `https`, since those are already handled internally by WebKit.
Apple's documentation for [setURLSchemeHandler(_:forURLScheme:)](https://developer.apple.com/documentation/webkit/wkwebviewconfiguration/seturlschemehandler(_:forurlscheme:)?language=objc) also notes:
> "It is a programmer error to register a handler for a scheme WebKit already handles, such as https, and this method raises an NSInvalidArgumentException if you try to do so."
One possible alternative would be running a local web server inside the app and serving content over HTTP or HTTPS. However, this is outside the scope of what Cordova currently provides, and supporting it would likely add additional complexity around networking, certificate handling, app lifecycle management, and platform-specific behavior.
There may already be Cordova plugins that support this type of functionality, although I’m not personally familiar with any specific implementations.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org