I have an iOS hybrid app centred around a WKWebView loading local web assets with loadFileURL. The WKWebView communicates over HTTPS to a backend API with jQuery.ajax. The app is mobile-only and I want the API to also be "mobile-only". That is, I want to block browsers such as Chrome and Firefox from using the API.
My strategy is to set the Access-Control-Allow-Origin header on API responses as follows:
Access-Control-Allow-Origin: app://myApp
Can I change the origin of the WKWebView to app://myApp to avoid browsers from querying the API?