cdvfile: not loading local cordova.js on IOS (even without https)

[manusis]

Bug Report

Problem

I am trying to load local cordova.js from a remote URL in my cordova(phonegap) application.

1. I am using http for the remote URL (to avoid mixed content warning).

2. I have added content security policy in the meta tag of my remote URL

<meta http-equiv="Content-Security-Policy" content="img-src * 'self' 'unsafe-inline' data:;default-src * gap://ready file: cdvfile: data:;style-src * 'self' 'unsafe-inline'; font-src * 'self' data:; script-src * 'self' file: cdvfile: 'unsafe-inline' 'unsafe-eval'">
3. I have added access origin

<access origin="*" /> <access origin="cdvfile://* />

I even tried the following:
<access allows-arbitrary-loads-for-media="true" allows-arbitrary-loads-in-web-content="true" allows-local-networking="true" origin="*" />

4. I am using <script src="cdvfile://localhost/bundle/www/cordova.js"> to load the cordova file?

I still keep getting the following error on IOS simulator (iphone X 11.0.1)

'An error occurred trying to load the resource.'

What else I might be missing?

Information

What is expected to happen?

Expecting the local cordova.js to load when using remote URL in my cordova application.

Command or Code

<script src="cdvfile://localhost/bundle/www/cordova.js" ></script>

Version information

MacOS 10.13.6 (High Sierra)

phonegap cli-8.1.1
cordova-plugin-file 6.0.2
iphone X 1.1.0.2 (Simulator)

Checklist

• I searched for existing GitHub issues
• I updated all Cordova tooling to most recent version
• I included all the necessary information above

[Lindsay-Needs-Sleep]

I believe these are related (maybe the same problem?):
Issue #295
pull request #296

[breautek]

Not 100% sure on this, but it might be because cdvfile is not a supported protocol for cors.

Android (chrome) will error, at least on XHR request from a remote url, explicitly stating that:

Cross origin requests are only supported for protocol schemes: http, data, chrome, https.

While here iOS isn't explicitly stating so, perhaps they have the same restriction? Just guessing here.

On a side note, it's not recommended to host your app code externally. If you access device native APIs from that external code then you are breaking terms of service agreement for both the Apple & Google Play store. Your app code should be bundled with the app itself.

[Lindsay-Needs-Sleep]

@breautek That sounds like a very reasonable guess.

On a side note, it's not recommended to host your app code externally. If you access device native APIs from that external code then you are breaking terms of service agreement for both the Apple & Google Play store. Your app code should be bundled with the app itself.

@breautek Would you be able to me to the section+link for these details?

@manusis
I use cordova-plugin-hostedwebapp to inject cordova.js onto my https pages. It is no longer really supported, but it still works after a couple tweaks. (Here is the fork I am using).

[vitto32]

On a side note, it's not recommended to host your app code externally. If you access device native APIs from that external code then you are breaking terms of service agreement for both the Apple & Google Play store. Your app code should be bundled with the app itself.

I agree, but it can be very useful while developing (I do use cordova-plugin-webpack in dev env).

[breautek]

@Lindsay-Needs-Sleep

I've documented the concern at apache/cordova-docs#1022 which includes text from both Apple's and Google's policies for their app stores. I've had discussions already so we won't deprecate or prevent developers from using remote sources because there are legit reasons why you may use a remote source (e.g. what @vitto32 is doing for development). This concern also only really applies if you're intending to distribute your app via the app stores. To keep this issue on topic, if you have more questions on this, feel free to comment on the cordova-docs issue I linked above.

On the topic issue, I don't have an easy access to a mac, but if someone could perhaps build a test case to test both cdvfile:// and https:// protocol for ios, or someone to confirm that csvfile:// is indeed the issue, I think that might help us move forward.

[breautek]

Closing this issue because cdvfile: support is going away, because it doesn't work properly on either cordova-ios or cordova-android while using schemes.