Skip to content

Instantly share code, notes, and snippets.

@zhuowei
Created September 1, 2020 04:47
Show Gist options
  • Save zhuowei/0b7074b3803d72609c028ab5723d9c28 to your computer and use it in GitHub Desktop.
Save zhuowei/0b7074b3803d72609c028ab5723d9c28 to your computer and use it in GitHub Desktop.
Disable same-origin policy on iOS WKWebView with private API.
// Allows disabling Same-Origin Policy on iOS WKWebView.
// Tested on iOS 12.4.
// Uses private API; obviously can't be used on app store.
@import WebKit;
@import ObjectiveC;
void WKPreferencesSetWebSecurityEnabled(id, bool);
@interface WDBFakeWebKitPointer: NSObject
@property (nonatomic) void* _apiObject;
@end
@implementation WDBFakeWebKitPointer
@end
void WDBSetWebSecurityEnabled(WKPreferences* prefs, bool enabled) {
Ivar ivar = class_getInstanceVariable([WKPreferences class], "_preferences");
void* realPreferences = (void*)(((uintptr_t)prefs) + ivar_getOffset(ivar));
WDBFakeWebKitPointer* fake = [WDBFakeWebKitPointer new];
fake._apiObject = realPreferences;
WKPreferencesSetWebSecurityEnabled(fake, enabled);
}
@PierceLBrooks
Copy link

@zhuowei , from your article ( https://worthdoingbadly.com/disablesameorigin/ ) on this technique, it appears you concluded that invokingWebKit::WebPreferences::setWebSecurityEnabled / WKPreferencesSetWebSecurityEnabled is not possible on MacOS due to missing symbol exports, and that only iOS is viable. Is that correct?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment