How to differentiate flows from a wkwebview app and from Safari Browser using sourceAppAuditToken of the flow?

How can we differentiate flows from a wkwebkit-webview app and flows from Safari Browser flows?

You can attempt to extract this from the flow.description, otherwise, you can try to extract the bundle identifier of the actual app sending the Network traffic from the signature as you previously mentioned from Quinn's post. This is assuming that the app contains a code signature.

/* If the info identifier is available, return this. */
if let identifier = info[kSecCodeInfoIdentifier as String] as? String {
	return identifier
}
/* Othewise look for the identifier in the plist */
guard
	let plist = info[kSecCodeInfoPList as String] as? [String:Any],
	let bundleID = plist[kCFBundleIdentifierKey as String] as? String
else {
	return nil
}

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

Thanks Matt, Agree with you on using flow.description for differentiate.Thank you.This works and I will mark as Answered.

I have taken a long route than direct one, Reason being to get more details and exact designated identifier from the SecCode.

Once we have the SecStaticCode :- I tried to extract it like following.

let flags = SecCSFlags(rawValue: 0)
var requirement: SecRequirement?
var text: CFString?

err = SecCodeCopyDesignatedRequirement(staticCode, flags, &requirement)
guard err == errSecSuccess else {
   return nil
}
err = SecRequirementCopyString(requirement!, flags, &text)
guard err == errSecSuccess else {
   return nil
}

'text' always returned as designated => identifier "com.apple.WebKit.Networking" , not as “com.apple.Safari”.

Is this expected for all webView app and Safari?

Is this expected for all webView app and Safari?

Well, for WkWebView apps, there networking can run out-of-process, so this could be what you are seeing. I would have expected that the traffic from Safari come from com.apple.safari thought, as this is what I am used to seeing in the logs.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

Thank you for the reply.

From the console logs, it will show com.apple.safari for flow description(Handling new flow - log), but the designated identifier derived from code for safari and webview apps are returning com.apple.WebKit.Networking.

Thats the observation I had, hence I raised this thread.