A PR handles social login by loading the login page inside a WKWebView. Why isn't that approach recommended?
An app-owned WebView lets the app capture the user's credentials through JS injection, which major identity providers ban by policy, and Safari's cookies aren't shared, so SSO doesn't work.
SecurityMultiple choiceBasics
You built a bridge with WKScriptMessageHandler so a web page can call native functions…
#wkwebview
SecurityShort answerAdvanced
Users report that the campaign page you load in an in-app WKWebView shows carrier or…
#wkwebview
App lifecycle and systemShort answerAdvanced
Most of the service is built in WKWebView, and you have to maintain the bridge the web…
#wkwebview