Search code examples
ioskeyboardwkwebviewsfsafariviewcontrollermobile-security

Prevent/disable 3rd party keyboards for WkWebView web views


Background:

The iOS app I am working on is a native app but has a few web views using SFSafariViewController. Due to security requirements, the app needs to prevent the user from using 3rd party keyboards for text inputs. This is very straightforward for native code using:

func application(_ application: UIApplication, shouldAllowExtensionPointIdentifier extensionPointIdentifier: UIApplication.ExtensionPointIdentifier) -> Bool {
    if extensionPointIdentifier == UIApplication.ExtensionPointIdentifier.keyboard {
        return false
    }
    return true
}

However this does not apply to the web views implemented using SFSafariViewController in that when a user tries to input text into a html text field, he is allowed to choose a 3rd party keyboard.

Our Pen Testing partners suggest reimplementing those web views in WKWebView instead.

Questions:

  1. Looking at SFSafariViewController and SFSafariViewControllerDelegate, I don't see any way to prevent 3rd party keyboard from being used, unless there is a way to do this using html or javascript maybe. If there is a way, would really appreciate help on how to do this?

  2. If I have to use WkWebView, will

func application(_ application: UIApplication, shouldAllowExtensionPointIdentifier extensionPointIdentifier: UIApplication.ExtensionPointIdentifier) -> Bool {
    if extensionPointIdentifier == UIApplication.ExtensionPointIdentifier.keyboard {
        return false
    }
    return true
}

also apply to WkWebView or is it purely for native code only? If not, how do I prevent/disable 3rd party keyboards from being used in html text boxes displayed in WkWebView?

Thanks in advance!


Solution

  • I believe I found the answer to my question

    func application(_ application: UIApplication, shouldAllowExtensionPointIdentifier extensionPointIdentifier: UIApplication.ExtensionPointIdentifier) -> Bool {
        if extensionPointIdentifier == UIApplication.ExtensionPointIdentifier.keyboard {
            return false
        }
        return true
    }
    

    In addition to preventing 3rd party keyboards from being used in native text fields, it also applies to html text fields rendered in WKWebView but not SFSafariViewController