
Security News
ECMAScript 2025 Finalized with Iterator Helpers, Set Methods, RegExp.escape, and More
ECMAScript 2025 introduces Iterator Helpers, Set methods, JSON modules, and more in its latest spec update approved by Ecma in June 2025.
cordova-plugin-safariviewcontroller
Advanced tools
Forget InAppBrowser for iOS - this is way better for displaying read-only web content in your PhoneGap app.
Note that I didn't decide to clobber window.open to override InAppBrowser when applicable because that would mean you could never use InAppBrowser in case you need its advanced features in one place and are happy with a simple readonly view in other cases.
As you can see from these shots: you can preload a page in reader mode or normal mode, and Safari gives you the option to use the share sheet!
Pressing 'Done' returns the user to your app as you'd expect.
This one has a custom tintColor
(check the buttons):
On iOS 10, you can use barColor
and controlTintColor
as well
(to make sure iOS 9 buttons are not white in the case, pass in a tintColor
as well):
To install the plugin with the Cordova CLI from npm:
$ cordova plugin add cordova-plugin-safariviewcontroller
Note: the plugin requires Cordova Android 7.0.0 or later.
** This section is kinda obsolete by now (with iOS 12 currently being the latest version) **
Since SafariViewController is new in iOS9 you need to have a fallback for older versions (and other platforms),
so if available
returns false (see the snippet below) you want to open the URL in the InAppBrowser probably,
so be sure to include that plugin as well:
$ cordova plugin add cordova-plugin-inappbrowser
I'm not including it as a dependency as not all folks may have this requirement.
Check the demo code for an easy to drop in example, otherwise copy-paste this:
function openUrl(url, readerMode) {
SafariViewController.isAvailable(function (available) {
if (available) {
SafariViewController.show({
url: url,
hidden: false, // default false. You can use this to load cookies etc in the background (see issue #1 for details).
animated: false, // default true, note that 'hide' will reuse this preference (the 'Done' button will always animate though)
transition: 'curl', // (this only works in iOS 9.1/9.2 and lower) unless animated is false you can choose from: curl, flip, fade, slide (default)
enterReaderModeIfAvailable: readerMode, // default false
tintColor: "#00ffff", // default is ios blue
barColor: "#0000ff", // on iOS 10+ you can change the background color as well
controlTintColor: "#ffffff" // on iOS 10+ you can override the default tintColor
},
// this success handler will be invoked for the lifecycle events 'opened', 'loaded' and 'closed'
function(result) {
if (result.event === 'opened') {
console.log('opened');
} else if (result.event === 'loaded') {
console.log('loaded');
} else if (result.event === 'closed') {
console.log('closed');
}
},
function(msg) {
console.log("KO: " + msg);
})
} else {
// potentially powered by InAppBrowser because that (currently) clobbers window.open
window.open(url, '_blank', 'location=yes');
}
})
}
function dismissSafari() {
SafariViewController.hide()
}
SFSafariViewController
.cordova-plugin-inappbrowser
is affected by ATS, this plugin is not. This means you can even load http
URL's without whitelisting them.SFSafariViewController implements "real" Safari, meaning private data like cookies and Keychain passwords are available to the user. However, for security, this means that communication features such as javascript, CSS injection and some callbacks that are available in UIWebView are not available in SFSafariViewController.
To pass data from a web page loaded in SFSafariViewController back to your Cordova app, you can use a Custom URL Scheme such as mycoolapp://data?to=pass. You will need to install an addition plugin to handle receiving data passed via URL Scheme in your Cordova app.
Combining the URL Scheme technique with the HIDDEN option in this plugin means you can effectively read data from Safari in the background of your Cordova app. This could be useful for automatically logging in a user to your app if they already have a user token saved as a cookie in Safari.
Do this:
Install the Custom URL Scheme Plugin
Create a web page that reads Safari data on load and passes that data to the URL scheme:
<html>
<head>
<script type="javascript">
function GetCookieData() {
var app = "mycoolapp"; // Your Custom URL Scheme
var data = document.cookie; // Change to be whatever data you want to read
window.location = app + '://?data=' + encodeURIComponent(data); // Pass data to your app
}
</script>
</head>
<body onload="GetCookieData()">
</body>
</html>
Open the web page you created with a hidden Safari view:
SafariViewController.show({
url: 'http://mycoolapp.com/hidden.html',
hidden: true,
animated: false
});
Capture the data passed from the web page via the URL Scheme:
function handleOpenURL(url) {
setTimeout(function() {
SafariViewController.hide();
var data = decodeURIComponent(url.substr(url.indexOf('=')+1));
console.log('Browser data received: ' + data);
}, 0);
}
hide()
(iOS). Thanks #104!hidden
property to show
.isAvailable
plays nice with non-iOS platforms. Added a transition
property to show
.show
, and added the animated
property to show
.FAQs
Forget InAppBrowser for iOS - this is way better for displaying read-only web content in your PhoneGap app.
The npm package cordova-plugin-safariviewcontroller receives a total of 3,546 weekly downloads. As such, cordova-plugin-safariviewcontroller popularity was classified as popular.
We found that cordova-plugin-safariviewcontroller demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
ECMAScript 2025 introduces Iterator Helpers, Set methods, JSON modules, and more in its latest spec update approved by Ecma in June 2025.
Security News
A new Node.js homepage button linking to paid support for EOL versions has sparked a heated discussion among contributors and the wider community.
Research
North Korean threat actors linked to the Contagious Interview campaign return with 35 new malicious npm packages using a stealthy multi-stage malware loader.