title: WKWebview [Warning] [blocked] The page at https://www.myurl.com was not allowed to display insecure content from mycustomscheme://?path=somepath
body: <p>I've recently replaced my <code>UIWebview</code> to a <code>WKWebview</code> in my hybrid app. I'm using a custom scheme to load images from the native part of the app as it's recommended by Apple here:
  <a href="https://developer.apple.com/videos/play/wwdc2017/220/" rel="noreferrer">https://developer.apple.com/videos/play/wwdc2017/220/</a></p>
  
  <p>I'm loading the images from a url that look like <code>mycustomscheme://?path=somepath</code></p>
  
  <p>I've added Content-Security-Policy header to allow for the mixed content, and it looks like this (irrelevant parts were removed):</p>
  
  <pre><code>Content-Security-Policy: default-src 'self' www.myurl.com ; img-src 'self' mycustomscheme: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' ; report-uri https://www.myreporturl.com/
  </code></pre>
  
  <p>This works for most devices and lets the request to <code>mycustomscheme</code> go through, and report to <code>myreporturl</code> if anything was blocked. However, on some devices the custom requests are blocked with this error:
  <code>[Warning] [blocked] The page at https://www.myurl.com was not allowed to display insecure content from mycustomscheme://?path=somepath</code> and no report is being sent to <code>myreporturl</code>, as if the header was not loaded at all. </p>
  
  <p>I've confirms that the header is actually sent, and that the problematic devices are running the latest iOS (12.1.4).</p>
  
  <p>Any advice on how to prevent my custom requests from getting blocked would be much appreciated! </p>