Can't get WebKit to display web page

Question

I'm trying to work out how to display a web page inside my IOS app. I've tried to carefully follow what information I can find. Here is what I'm using:

@implementation FirstViewController

- (void)viewDidLoad {
    [super viewDidLoad];
    self.productURL = @"http://google.com/";

    NSURL *url = [NSURL URLWithString:self.productURL];
    NSURLRequest *request = [NSURLRequest requestWithURL:url];

    _webView = [[WKWebView alloc] initWithFrame:self.view.frame];
    [_webView loadRequest:request];
    _webView.frame = CGRectMake(self.view.frame.origin.x+50,self.view.frame.origin.y+50, self.view.frame.size.width-100, self.view.frame.size.height-200);
    printf("\nReady to add the Subview");
    self.view.backgroundColor = [UIColor blueColor];
    [self.view addSubview:_webView];
    printf("\nSubView has been added");
 }

@end

The frame is offset in the above so I could color it and see that the subview would be positioned there. The web page should appear in the subview as I understand it, but I just get a blank page.

I also added NSExceptionDomains dictionary to my Info.plist and added google.com with it having a dictionary contains NSIncludesSubdomains set to true and NSExceptionAllowsInsecureHTTPLoads set to true thinking that might be the problem, but to no avail. I've tried several urls and same thing.

How can I find out what is happening and fix it?

Answer 1

I found the problem! Apparently I needed to add the key 'App Transport Security Settings' as a dictionary to my Info.plist and add the key 'Allow Arbitrary Loads' as true to that. It now displays!

I could not find this before, but when I did and added it, it worked fine with the code just as above.

Answer 2

I know you have found the solution. But here I want to explain what is wrong with the code. The code is actually fine. The issue is you are trying to open an insecure URL http://google.com/. Any URL that starts with http:// will get blocked by iOS. Only URL that starts with https:// will be allowed without any "App Transport Security Settings".

In your case you actually has 2 options:

1. Add App Transport Security Settings.
2. Ensure you only calls https:// URL. You can change https://google.com and it should work without adding any App Transport Security Settings.

As for the options that you add "Allow Arbitrary Loads" is ok for testing, but what you really need to do is add exception domains in your App Transport Security Settings. That way your app only accepts related URL only, and not ANY old URL that could've been opened by malicious url injection.