Is it possible to allow `unsafe-eval` for native app webview hosts, while denying it to other content?

Issue

I'm looking to implement bidirectional communication between native iOS/Android webview controllers and the javascript context of the webview's current loaded content. Here's what I've got so far:

• I can achieve js -> app communication by using WKScriptMessageHandler (iOS) and AddJavascriptInterface (Android).
• For app -> js communication, I am able to inject script as the page is being loaded, but I want to be able to call into javascript when the page is "running" as well. Both WKWebView and Android's WebView support an Eval-type function, but this is disallowed by the browser engine unless unsafe-eval is granted by the web page's content's Content Security Policy (which we don't want to allow, in general.) I can control the CSP, so I'm wondering if it's possible to formulate a CSP which will deny unsafe-eval in general, while specifically whitelisting the "domain" represented by the app itself?

Or perhaps another way to achieve that kind of communication that doesn't involve loosening the CSP? This would theoretically be possible via the web page listening to a websocket and the app sending messages to a server which would then forward to the websocket, but that seems pretty heavy-handed.

Thanks for any suggestions!

Solution

'unsafe-eval' acts as a global page flag, therefore you can't use it in granular mode.

Full-fledged bidirectional communication is possible only with using WebSockets.

Also to initiate communication from the application side, you can use XMLHttpRequest.
And to initiate communication from the server side, you can use Server-Sent Events (SSE). You can have a look on Mercure: a real-time communication protocol (publish-subscribe) built on top of SSE.

Answered By - granty