I'm trying to get password autofill working again in OmniWeb after porting to WKWebView. Because WKWebView doesn't have any direct API to support this, I've registered a WKUserScript which catches events on password fields and calls back to the app to look up the site's password in the keychain. This works fine for the main frame and for any child frames which share the security origin of the main frame, since I can register some callback functions on window.top. But CORS makes this impossible when the child frame has a different security origin (such as with appstoreconnect.apple.com with its embedded iframe at idmsa.apple.com). It would be great if WKScriptMessageHandler had some way to get results back to the frame which called it--for example, if it could pass the WKFrameInfo from its received WKScriptMessage to a variant of WKWebView's -evaluateJavaScript:completionHandler: to evaluate a script in the context of that originating frame. There may be other ways to solve the specific use case of implementing password autofill—but, generally speaking, it seems like a very big limitation that WKScriptMessageHandler is unable to call back to the JavaScript context which called it to return results to the invoking context. (Thanks in advance for considering this!)
<rdar://problem/57461911>
Due to lots of people reporting this in lots of different venues and lots of conversations happening around them at different times... I worked on this in a newer bug report. So sorry for the reverse dupe! *** This bug has been marked as a duplicate of bug 213556 ***