How do you use WKWebView safely?
Essence
A WebView is a browser inside your app, but with access to things a browser doesn't have: your cookies, a JS bridge into native code, the app's files. So the main questions are what content gets loaded and what that content is allowed to do. The closer a WebView is to the user's session and native capabilities, the more strictly you must limit where it can navigate.
The rest of this answer, with code and interview follow-ups, is in the DevPrep app.
Read the full answer in DevPrep