WKWebView bridge

Pick all that apply

• 1Choice 1.

  Check message.frameInfo.securityOrigin (or the URL) against an allowlist on every bridge call

• 2Choice 2.

  Return as little as possible from native, performing the action on the page's behalf instead of handing back the raw token

• 3Choice 3.

  Use WKContentWorld to separate the page's JS from the scripts the app injects

• 4Choice 4.

  It passed ATS, so a call from any page is safe

• 5Choice 5.

  Obfuscating the bridge name so it's hard to guess is enough