3 ms·

Safari webview (WebKit) is what it's describing

• pantulis 4y ago
  The key aspect here is that Instagram's app is using a Safari Webview but somehow it is injecting its own tracking pixel on the HTML body wether the target website had it or not. Which honestly does not surprise me, what surprises me is that Apple allows this. I think there was a time where certain Javascript capabilities were present in Safari but not in Safari Webview and there was certain outrage. Perhaps a solution would be to run the webview through Safaris content blocker engine?
  • saagarjha 4y ago
    To what? Disable the ability to inject JavaScript into the web view?
    • pantulis 4y ago
      Yes. Is there a legitimate use case for injecting arbitrary Javascript by the native app? (Honest question)
      • rawling 4y ago
        Apps that use html for their UI and JS hooks to trigger touch ID, access the keychain etc.
        • pantulis 4y ago
          Thanks!