Wrapping a web app in a native shell lets you call any API available on iOS, thanks to native bridges. But it may also enable malicious actors to do the same if your native shell accidentally opens an infected page, so ensuring its security becomes top priority.
In this video, I demonstrate how a poorly configured native bridge becomes an open door for attackers, enabling remote code execution and data exfiltration in your WebKit native shell. Right after that, I explain the key security mechanisms for preventing such incidents on iOS. Among them are the familiar App Transport Security system (which has a few important distinctions when it’s used for web content) and a little-known but extremely useful feature called App-Bound Domains (a WebKit blog post is about the only official place to learn about it; Apple’s developer documentation completely ignores it).
Used together, these straightforward technical measures let you achieve the flexibility of a hybrid app without compromising its security.