When you need to show web content inside your iOS app, you have three main options: open Safari directly, use WKWebView, or use SFSafariViewController. Each has different tradeoffs, and each interacts with Universal Links in a distinct way. Choosing the wrong one can create confusing behavior for users who expect deep links to work seamlessly.<\/p>\n\n\n\n
This article explains what SFSafariViewController is, how it handles Universal Links, when to use it versus the alternatives, and best practices for integrating it into apps that rely on deep linking.<\/p>\n\n\n\n
For WKWebView deep linking, see handling Universal Links in WKWebView<\/a>. For Universal Links fundamentals, see universal links: everything you need to know<\/a>.<\/p>\n\n\n\n SFSafariViewController (introduced in iOS 9) presents a Safari browser interface as a view controller within your app. It is not a custom WebView. It is a sandboxed instance of Safari running inside your app's UI hierarchy.<\/p>\n\n\n\n From the user's perspective it looks like an in-app browser with a Safari-style toolbar. From a technical perspective, it shares Safari's cookie store, content blockers, and JavaScript engine. The key implication for deep linking: it shares Safari's Universal Link behavior.<\/p>\n\n\n\n Apple's reference documentation is at SFSafariViewController<\/a>.<\/p>\n\n\n\n This is the most important thing to understand. Because SFSafariViewController is technically running Safari (not a custom WebView), Universal Links work from it exactly as they do from the Safari browser. When a user taps a Universal Link inside an SFSafariViewController, iOS will open the target app if it is installed and if the Associated Domains configuration is correct.<\/p>\n\n\n\n This is the opposite of WKWebView, which does not automatically dispatch Universal Links to the system. For a comparison, see handling Universal Links in WKWebView<\/a>.<\/p>\n\n\n\n The API is minimal by design:<\/p>\n\n\n\n Unlike WKWebView, you cannot intercept navigation events or inject JavaScript. SFSafariViewController is intentionally opaque. You know the initial URL you present, and you get a callback when the user is done. Everything in between is Safari's domain.<\/p>\n\n\n\n While SFSafariViewController is opaque in terms of navigation, it does offer some appearance customization:<\/p>\n\n\n\n These options let the in-app browser feel more consistent with your app's visual design without requiring you to build a custom WebView.<\/p>\n\n\n\n The This limitation matters for deep link flows. If a Universal Link is tapped inside SFSafariViewController and the target app is installed, iOS will open that app. The SFSafariViewController remains in your app's view hierarchy but loses focus. When the user returns to your app, you may need to handle the state that was active when they left.<\/p>\n\n\n\n A common pattern is to dismiss the SFSafariViewController in your app's scene activation callback:<\/p>\n\n\n\n For OAuth and other web-based authentication flows, SFSafariViewController was commonly used in iOS 9-11. Apple deprecated this pattern in iOS 11 and introduced ASWebAuthenticationSession as the dedicated solution.<\/p>\n\n\n\n ASWebAuthenticationSession is specifically designed for authentication redirects. It handles the callback URL and dismisses itself automatically when the redirect is received.<\/p>\n\n\n\n Apple's documentation: ASWebAuthenticationSession<\/a>.<\/p>\n\n\n\n Key advantages over SFSafariViewController for auth:<\/p>\n\n\n\n Use SFSafariViewController for general web content browsing. Use ASWebAuthenticationSession for authentication callbacks.<\/p>\n\n\n\n Because SFSafariViewController shares Safari's cookie store, users who are logged into a website in Safari will also be logged in when you open that site via SFSafariViewController. This is often desirable (frictionless experience) but has implications:<\/p>\n\n\n\nWhat Is SFSafariViewController?<\/h2>\n\n\n\n
Universal Links Trigger From SFSafariViewController<\/h2>\n\n\n\n
Presenting SFSafariViewController<\/h2>\n\n\n\n
import SafariServices\n\nclass ViewController: UIViewController {\n\n func openWebContent(url: URL) {\n let safariVC = SFSafariViewController(url: url)\n safariVC.delegate = self\n present(safariVC, animated: true)\n }\n}\n\nextension ViewController: SFSafariViewControllerDelegate {\n\n func safariViewControllerDidFinish(_ controller: SFSafariViewController) {\n \/\/ User tapped Done or the view controller was dismissed\n controller.dismiss(animated: true)\n }\n}\n<\/code><\/pre>\n\n\n\nCustomization Options<\/h2>\n\n\n\n
let safariVC = SFSafariViewController(url: url)\n\n\/\/ Tint the control buttons (done button, share button)\nsafariVC.preferredControlTintColor = .systemBlue\n\n\/\/ Set a bar background color\nsafariVC.preferredBarTintColor = UIColor(named: "BrandColor")\n\n\/\/ Choose the dismiss button style\nsafariVC.dismissButtonStyle = .close \/\/ or .cancel, .done\n\npresent(safariVC, animated: true)\n<\/code><\/pre>\n\n\n\nThe Dismiss Callback and Deep Link Flows<\/h2>\n\n\n\n
SFSafariViewControllerDelegate<\/code> protocol provides the safariViewControllerDidFinish<\/code> callback, which fires when the user explicitly closes the view controller (taps "Done" or "Close"). There is no callback for navigation events within the browser.<\/p>\n\n\n\n\/\/ In SceneDelegate.swift\nfunc sceneDidBecomeActive(_ scene: UIScene) {\n dismissPresentedSafariViewControllerIfNeeded()\n}\n\nfunc dismissPresentedSafariViewControllerIfNeeded() {\n if let presented = navigationController?.presentedViewController\n as? SFSafariViewController {\n presented.dismiss(animated: false)\n }\n}\n<\/code><\/pre>\n\n\n\nAuthentication: Use ASWebAuthenticationSession Instead<\/h2>\n\n\n\n
import AuthenticationServices\n\nclass AuthViewController: UIViewController {\n\n var authSession: ASWebAuthenticationSession?\n\n func startOAuthFlow() {\n let authURL = URL(string:\n "https:\/\/auth.provider.com\/oauth\/authorize?client_id=YOUR_ID&redirect_uri=yourapp:\/\/auth\/callback"\n )!\n let callbackScheme = "yourapp"\n\n authSession = ASWebAuthenticationSession(\n url: authURL,\n callbackURLScheme: callbackScheme\n ) { [weak self] callbackURL, error in\n guard error == nil, let callbackURL = callbackURL else {\n return\n }\n self?.handleAuthCallback(callbackURL)\n }\n\n authSession?.presentationContextProvider = self\n authSession?.prefersEphemeralWebBrowserSession = false\n authSession?.start()\n }\n}\n\nextension AuthViewController: ASWebAuthenticationPresentationContextProviding {\n func presentationAnchor(for session: ASWebAuthenticationSession)\n -> ASPresentationAnchor {\n return view.window!\n }\n}\n<\/code><\/pre>\n\n\n\n\n
prefersEphemeralWebBrowserSession = true<\/code>) avoid sharing cookies with Safari.<\/li>\nCookie Sharing Behavior<\/h2>\n\n\n\n
\n
When to Choose Each Option<\/h2>\n\n\n\n