Add `WebviewBuilder::limit_navigations_to_app_bound_domains` by zphrs · Pull Request #13848 · tauri-apps/tauri

zphrs · 2025-07-17T23:03:50Z

closes #13847.

Draft because this can only be merged once Wry's version gets bumped to 0.52.1 or greater. Blocked by Wry PR #1578.

zphrs · 2026-01-04T21:51:15Z

@FabianLars sorry I just got to rebasing, this should be good to merge in. LMK if there's any changes I should make.

FabianLars · 2026-01-05T12:27:18Z

no worries and thanks for the PR :)

github-actions · 2026-01-05T12:27:54Z

Package Changes Through `ce6dafb`

There are 14 changes which include tauri with minor, tauri-cli with minor, @tauri-apps/cli with minor, tauri-runtime with minor, tauri-runtime-wry with minor, tauri-utils with minor, tauri-bundler with minor, tauri-build with minor, tauri-macos-sign with minor, tauri-codegen with minor, tauri-macros with minor, tauri-plugin with minor, tauri-driver with minor, @tauri-apps/api with minor

Planned Package Versions

The following package releases are the planned based on the context of changes in this pull request.

package	current	next
@tauri-apps/api	2.11.1	2.12.0
tauri-utils	2.9.3	2.10.0
tauri-macos-sign	2.3.4	2.4.0
tauri-bundler	2.9.4	2.10.0
tauri-runtime	2.11.3	2.12.0
tauri-runtime-wry	2.11.4	2.12.0
tauri-codegen	2.6.3	2.7.0
tauri-macros	2.6.3	2.7.0
tauri-plugin	2.6.3	2.7.0
tauri-build	2.6.3	2.7.0
tauri	2.11.5	2.12.0
@tauri-apps/cli	2.11.4	2.12.0
tauri-cli	2.11.4	2.12.0
tauri-driver	2.0.6	2.1.0

Add another change file through the GitHub UI by following this link.

Read about change files or the docs at github.com/jbolda/covector

zphrs · 2026-03-06T21:21:00Z

@FabianLars are there any further changes you'd like me to make before this gets merged in?

FabianLars · 2026-03-18T15:59:08Z

do you think this should be configurable in tauri.conf.json as well?

…nly on iOS.

zphrs · 2026-03-18T22:20:34Z

do you think this should be configurable in tauri.conf.json as well?

Sure! I wired this up.

zphrs · 2026-07-08T00:41:39Z

@Legend-Master just checking in since I saw you added the 2.12 label recently. Should I rebase my changes again?

Legend-Master · 2026-07-08T01:37:54Z

Yes, I personally prefer a merge so we don't lose the review history from a rebase + force push, but do whatever you prefer

zphrs · 2026-07-08T04:20:38Z

Yes, I personally prefer a merge so we don't lose the review history from a rebase + force push, but do whatever you prefer

done!

Legend-Master · 2026-07-08T04:28:30Z

Apart from the missing ,, looks like this is also available on macOS right?

https://developer.apple.com/documentation/webkit/wkwebviewconfiguration/limitsnavigationstoappbounddomains

zphrs · 2026-07-08T21:18:05Z

Apart from the missing ,, looks like this is also available on macOS right?

https://developer.apple.com/documentation/webkit/wkwebviewconfiguration/limitsnavigationstoappbounddomains

It seems that limitAppBoundDomains can be set in MacOS as well but based on searching through the WebKit source code, the sole WebKit issue mentioning limitAppBoundDomains and MacOS (https://bugs.webkit.org/show_bug.cgi?id=216628), and the blog post on App-Bound Domains the flag doesn't change any behavior on MacOS; in fact the internal getter for whether it is set is gated behind a #if PLATFORM(IOS_FAMILY) flag [source code]. I also just messaged the WebKit #help slack channel and am waiting for a response.

If we do want to have it set the flag on MacOS as well then I'd have to go back and edit Wry as well and I think it's unnecessary to have it do anything on MacOS because the flag only seems to be checked on iOS.

Legend-Master · 2026-07-09T01:52:11Z

Thanks for the detailed digging! We can merge this first and if it ever gets supported on macOS in the future we can always add that then.

Legend-Master

Nice work, thanks!

Just a new nitpicks and we can get this merged.

zphrs · 2026-07-10T18:12:07Z

When re-reading the doc comment while making the above fixes I realized I forgot to implement this:

Assets served through custom protocols like Tauri's IPC are added to the list automatically.

Because we don't know what domains people use for their custom protocols at build time (e.g. custom://domain1, custom://domain2, etc.), I'll change the comment to be:

Assets served through custom protocols configured by Tauri (tauri://localhost, ipc://localhost, and 
isolation-{uuid}://localhost) are added to the WKAppBoundDomains list automatically. Domains on 
protocols defined via 
[`register_asynchronous_uri_scheme_protocol`](tauri::Builder::register_asynchronous_uri_scheme_protocol) 
or [`register_uri_scheme_protocol`](tauri::Builder::register_uri_scheme_protocol) are not added 
automatically. If you use a custom protocol, be sure to list all domains you use on such protocols 
in the Info.plist file.

I'll try to get the automatic Info.plist additions implemented today. I also just pushed the nits from your review.

zphrs · 2026-07-10T21:54:48Z

After inspecting the WebKit source code, I found that the ENABLE_APP_BOUND_DOMAINS is only set to true if PLATFORM(IOS_FAMILY):
https://github.com/WebKit/WebKit/blob/1029c99e92ffa6735a57c79f0d436702f27e0e38/Source/WTF/wtf/PlatformEnableCocoa.h#L83-L85

It also seems that simply adding localhost to the WKAppBoundDomains Info.plist field will automatically allow any protocol's localhost domain based on reading through the source code. See:
https://github.com/WebKit/WebKit/blob/898be46c29af657b82dab5b773edffa86e31715e/Source/WebKit/UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm#L685-L694

and:

https://github.com/WebKit/WebKit/blob/898be46c29af657b82dab5b773edffa86e31715e/Source/WebCore/platform/RegistrableDomain.h#L43-L46

that uses:

https://github.com/WebKit/WebKit/blob/898be46c29af657b82dab5b773edffa86e31715e/Source/WebCore/platform/RegistrableDomain.h#L118-L124

Note that "https" is added just to immediately be stripped for actually constructing the list of domains that are app-bound. Also see the following for where schemes and domains are checked for app-boundedness. Note especially that either the protocol must be app-bound or the domain must be app-bound.

https://github.com/WebKit/WebKit/blob/898be46c29af657b82dab5b773edffa86e31715e/Source/WebKit/UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm#L732-L737

So I will just add localhost by default to the WKAppBoundDomains Info.plist field if limitNavigationsToAppBoundDomains is set in the tauri config.

…ion.

…ains` array in `Info.plist` when `limitNavigationsToAppBoundDomains` is enabled. Update the `merge_plist` helper to merge arrays in place while skipping duplicate entries.

zphrs · 2026-07-11T01:01:54Z

@Legend-Master Sorry I forgot to add the automatic addition of localhost to the Info.plist file if limitNavigationsToAppBoundDomains is set in the tauri.config.json file. Now I believe this PR should be good to go.

…arameter

… to match.

zphrs · 2026-07-16T20:55:55Z

@FabianLars @Legend-Master I've reverted the automatic addition of WKAppBoundDomains and updated the documentation accordingly. Hopefully this PR is finally good to go 😅

Legend-Master

Thanks! Sorry about the wait the and thanks for the patience!

~~Just another day, we'll be able to celebrate the anniversary of this PR 😂~~

WSH032 mentioned this pull request Aug 11, 2025

Apply Version Updates From Current Changes tauri-apps/wry#1578

Closed

zphrs force-pushed the app-bound-domains branch 2 times, most recently from ce543a7 to 9e14491 Compare January 4, 2026 19:36

zphrs marked this pull request as ready for review January 4, 2026 21:50

zphrs requested a review from a team as a code owner January 4, 2026 21:50

zphrs changed the title ~~Draft: Add WebviewBuilder::limit_navigations_to_app_bound_domains~~ Add WebviewBuilder::limit_navigations_to_app_bound_domains Jan 4, 2026

FabianLars reviewed Jan 5, 2026

View reviewed changes

Comment thread crates/tauri-runtime/src/webview.rs Outdated

FabianLars reviewed Jan 5, 2026

View reviewed changes

Comment thread .changes/app-bound-domains.md Outdated

zphrs force-pushed the app-bound-domains branch 2 times, most recently from 15847b7 to 1aa5ad0 Compare January 14, 2026 19:41

zphrs force-pushed the app-bound-domains branch from 1aa5ad0 to 0f5a63e Compare January 25, 2026 06:37

zphrs force-pushed the app-bound-domains branch from 0f5a63e to 0098ad8 Compare March 6, 2026 21:20

zphrs requested a review from FabianLars March 17, 2026 14:31

zphrs added 4 commits March 18, 2026 14:07

Draft: Add WebviewBuilder::limit_navigations_to_app_bound_domains o…

1d9cecc

…nly on iOS.

removed cfg flag from new setters

97d997d

change version bump to minor

2cb128f

fix clippy lint for limit_navigations_to_app_bound_domains

4cd3920

zphrs force-pushed the app-bound-domains branch from 0098ad8 to 4cd3920 Compare March 18, 2026 21:09

add tauri.conf.json support, polish doc comments

64baa58

Legend-Master added this to the 2.12 milestone Jun 1, 2026

Merge remote-tracking branch 'origin/dev' into app-bound-domains

a965ef8

add back missing comma, autogenerate config files

cb54fbf

Legend-Master previously approved these changes Jul 9, 2026

View reviewed changes

Comment thread .changes/app-bound-domains.md

Comment thread crates/tauri-utils/src/config.rs

Legend-Master reviewed Jul 9, 2026

View reviewed changes

Comment thread crates/tauri-runtime/src/webview.rs Outdated

minor documentation formatting changes

158b845

zphrs dismissed Legend-Master’s stale review via 158b845 July 10, 2026 18:12

zphrs added 2 commits July 10, 2026 16:15

Fix limitNavigationsToAppBoundDomains config binding, edit documentat…

d95664a

…ion.

Have the CLI automatically inject localhost into the `WKAppBoundDom…

a264845

…ains` array in `Info.plist` when `limitNavigationsToAppBoundDomains` is enabled. Update the `merge_plist` helper to merge arrays in place while skipping duplicate entries.

zphrs requested a review from Legend-Master July 11, 2026 01:02

Legend-Master reviewed Jul 11, 2026

View reviewed changes

Comment thread crates/tauri-cli/src/helpers/plist.rs Outdated

Comment thread crates/tauri-cli/src/mobile/ios/build.rs Outdated

zphrs added 4 commits July 13, 2026 14:04

Extract all window domains for WKAppBoundDomains array

deb241d

refine docs for limit_navigations_to_app_bound_domains WindowConfig p…

d4284bb

…arameter

Revert automatic insertion of WKAppBoundDomains, update documentation…

72a6ad1

… to match.

have docs specify tauri-src/Info.ios.plist

cc6a952

Legend-Master and others added 5 commits July 17, 2026 10:07

Merge branch 'dev' into app-bound-domains

aecf208

cli doesn't have changes anymore

47292e9

Combine ios blocks

3301356

Remove duplicated builder call

4996e85

format

ce6dafb

Legend-Master approved these changes Jul 17, 2026

View reviewed changes

Legend-Master merged commit 3f62c70 into tauri-apps:dev Jul 17, 2026
30 checks passed

github-actions Bot mentioned this pull request Jul 17, 2026

Apply Version Updates From Current Changes #15634

Draft

Uh oh!

Uh oh!

Conversation

zphrs commented Jul 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zphrs commented Jan 4, 2026

Uh oh!

Uh oh!

Uh oh!

FabianLars commented Jan 5, 2026

Uh oh!

github-actions Bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Package Changes Through ce6dafb

Uh oh!

zphrs commented Mar 6, 2026

Uh oh!

FabianLars commented Mar 18, 2026

Uh oh!

zphrs commented Mar 18, 2026

Uh oh!

zphrs commented Jul 8, 2026

Uh oh!

Legend-Master commented Jul 8, 2026

Uh oh!

zphrs commented Jul 8, 2026

Uh oh!

Legend-Master commented Jul 8, 2026

Uh oh!

zphrs commented Jul 8, 2026

Uh oh!

Legend-Master commented Jul 9, 2026

Uh oh!

Legend-Master left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zphrs commented Jul 10, 2026

Uh oh!

zphrs commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zphrs commented Jul 11, 2026

Uh oh!

Uh oh!

Uh oh!

zphrs commented Jul 16, 2026

Uh oh!

Legend-Master left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

zphrs commented Jul 17, 2025 •

edited

Loading

github-actions Bot commented Jan 5, 2026 •

edited

Loading

Package Changes Through `ce6dafb`

zphrs commented Jul 10, 2026 •

edited

Loading

Legend-Master left a comment •

edited

Loading