Setting "Disable web security" and "allow file access from files" in iOS WKWebView

You can also add a custom URL scheme handler to the WKWebView and use that scheme in your web page. This custom scheme handler can then load data from any arbitrary location. It should be noted that this loads the entire file into memory, so it won't work for huge files.

let configuration = WKWebViewConfiguration()
configuration.setURLSchemeHandler(MySchemeHandler(), forURLScheme: "MyScheme")
let webView = WKWebView(frame: .zero, configuration: configuration)

Your MySchemeHandler needs to implement webView(_ webView: WKWebView, start urlSchemeTask: WKURLSchemeTask) and webView(_ webView: WKWebView, stop urlSchemeTask: WKURLSchemeTask) (although the latter can be empty). Then, convert the custom URL into a file URL and load the file.

Loading the file seems to be a pain. There might be a better way, but this is what we use:

URLSession.shared.dataTask(with: fileUrl) { data, response, error in
    if error != nil {
        // cancel
        return
    }
    let taskResponse: URLResponse
    if #available(iOS 13, *) {
        taskResponse = HTTPURLResponse(url: urlSchemeTask.request.url!, mimeType: response?.mimeType, expectedContentLength: Int(response?.expectedContentLength ?? 0), textEncodingName: response?.textEncodingName)
    } else {
        // The HTTPURLResponse object created above using the URLResponse constructor crashes when sent to
        // urlSchemeTask.didReceive below in iOS 12. I have no idea why that is, but it DOESN'T crash if we
        // instead use the HTTPURLResponse-only constructor. Similarly, it doesn't crash if we create a
        // URLResponse object instead of an HTTPURLResponse object. So, if we know the mimeType, construct an
        // HTTPURLResponse using the HTTPURLResponse constructor, and add the appropriate header field for that
        // mime type. If we don't know the mime type, construct a URLResponse instead.
        if let mimeType = response?.mimeType {
            // The imodeljs code that loads approximateTerrainHeights.json requires the HTTP Content-Type header
            // to be present and accurate. URLResponse doesn't have any headers. I have no idea how the
            // HTTPURLResponse contstructor could fail, but just in case it does, we fall back to the
            // URLResponse object.
            taskResponse = HTTPURLResponse(url: urlSchemeTask.request.url!, statusCode: 200, httpVersion: "HTTP/1.1", headerFields: ["Content-Type": "\(mimeType); charset=UTF-8"]) ?? URLResponse(url: urlSchemeTask.request.url!, mimeType: response?.mimeType, expectedContentLength: Int(response?.expectedContentLength ?? 0), textEncodingName: response?.textEncodingName)
        } else {
            taskResponse = URLResponse(url: urlSchemeTask.request.url!, mimeType: response?.mimeType, expectedContentLength: Int(response?.expectedContentLength ?? 0), textEncodingName: response?.textEncodingName)
        }
    }
    urlSchemeTask.didReceive(taskResponse)
    urlSchemeTask.didReceive(data!)
    urlSchemeTask.didFinish()
}.resume()