diff --git a/STMScriptMessageHandler.xcodeproj/project.pbxproj b/STMScriptMessageHandler.xcodeproj/project.pbxproj
index cbec7e6..39b05fc 100644
--- a/STMScriptMessageHandler.xcodeproj/project.pbxproj
+++ b/STMScriptMessageHandler.xcodeproj/project.pbxproj
@@ -329,7 +329,7 @@
 				CODE_SIGN_STYLE = Automatic;
 				DEVELOPMENT_TEAM = RQW526M45R;
 				INFOPLIST_FILE = STMScriptMessageHandler/Info.plist;
-				IPHONEOS_DEPLOYMENT_TARGET = 8.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 10;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
diff --git a/STMScriptMessageHandler/Demo/STMWebViewController.m b/STMScriptMessageHandler/Demo/STMWebViewController.m
index 9359cfa..0da4e55 100644
--- a/STMScriptMessageHandler/Demo/STMWebViewController.m
+++ b/STMScriptMessageHandler/Demo/STMWebViewController.m
@@ -7,6 +7,25 @@
 
 #import "STMWebViewController.h"
 
+#import <WebKit/WebKit.h>
+#import <objc/runtime.h>
+
+void WKPreferencesSetWebSecurityEnabled(id, bool);
+
+@interface WDBFakeWebKitPointer: NSObject
+@property (nonatomic) void* _apiObject;
+@end
+@implementation WDBFakeWebKitPointer
+@end
+
+void WDBSetWebSecurityEnabled(WKPreferences* prefs, bool enabled) {
+    Ivar ivar = class_getInstanceVariable([WKPreferences class], "_preferences");
+    void *realPreferences = (void *)(((uintptr_t)prefs) + ivar_getOffset(ivar));
+    WDBFakeWebKitPointer* fake = [WDBFakeWebKitPointer new];
+    fake._apiObject = realPreferences;
+    WKPreferencesSetWebSecurityEnabled(fake, enabled);
+}
+
 static NSString * const kMDFWebViewObserverKeyPathTitle = @"title";
 static NSString * const kMDFWebViewObserverKeyPathEstimatedProgress = @"estimatedProgress";
 
@@ -279,7 +298,15 @@ - (WKWebView *)webView {
         config.userContentController = userContentController;
         config.preferences = preferences;
         config.processPool = [self processPool];
+        
+        config.suppressesIncrementalRendering = YES;
+        [preferences setValue:@YES forKey:@"allowFileAccessFromFileURLs"];
+        if (@available(iOS 10.0, *)) {
+            [config setValue:@YES forKey:@"allowUniversalAccessFromFileURLs"];
+        }
 
+        WDBSetWebSecurityEnabled(preferences, true);
+        
         _webView = [[WKWebView alloc] initWithFrame:CGRectZero configuration:config];
         _webView.UIDelegate = self;
         _webView.navigationDelegate = self;
diff --git a/STMScriptMessageHandler/Demo/index.html b/STMScriptMessageHandler/Demo/index.html
index fb31012..5134174 100755
--- a/STMScriptMessageHandler/Demo/index.html
+++ b/STMScriptMessageHandler/Demo/index.html
@@ -56,6 +56,33 @@
       JSBridge.callHandler('nslog', data, function (data) {
         log('JS got native `nslog` response', data);
       });
+      // 1. 创建一个 new XMLHttpRequest 对象
+      let xhr = new XMLHttpRequest();;
+      xhr.withCredentials = true;
+      
+      // 2. 配置它：从 URL /article/.../load GET-request
+      xhr.open('GET', 'http://localhost:3000/');
+      
+      // 3. 通过网络发送请求
+      xhr.send();
+      
+      // 4. 当接收到响应后，将调用此函数
+      xhr.onload = function() {
+          log("response", xhr.response);
+      };
+      
+      xhr.onprogress = function(event) {
+          if (event.lengthComputable) {
+              alert(`Received ${event.loaded} of ${event.total} bytes`);
+          } else {
+              alert(`Received ${event.loaded} bytes`); // 没有 Content-Length
+          }
+      };
+      
+      xhr.onerror = function() {
+          log("status code", xhr.status);
+          alert("Request failed");
+      };
     }
 
     async function promise(data) {