After analyzing my webserver logs, it appears that an iOS 14 device is categorizing one of my Javascript files as "injected". This file seems to be operating in a separate environment or namespace. As a result, any AJAX attempts made by the script fail because the assigned "origin" does not match my webserver, triggering the same-origin policy restriction.
This scenario would make sense if I was attempting something malicious, but in reality, it's just standard Javascript code that functions correctly on other browsers. The Javascript file is loaded externally in the usual manner within the head section of its HTML page:
<script type="text/javascript" src="foobar.js?baz"></script>All the page files, including the problematic Javascript, are sourced from the same domain -
How can I identify the root cause of this issue from the server side? Unfortunately, I am unable to replicate the problem from the client end, particularly since I lack access to an iPhone experiencing the failure.
UPDATE - April 23, 2021: The problem somewhat resolves on iPhone versions beyond 14.0.3, but still persists to some extent.