Intent to Prototype: Isolated Web Apps

[Reilly Grant]

Contact emails

rei...@chromium.org, pjmcl...@chromium.org

Explainer

https://github.com/reillyeon/isolated-web-apps/blob/main/README.md

Specification

Still at the explainer stage.

Summary

Isolated Web Apps extend Progressive Web App installation and Web Packaging to provide stronger protection against server compromise and other tampering.  A small set of security-sensitive applications require this to migrate from Chrome Apps, Electron, or other web-adjacent solutions.

Rather than being hosted on live web servers and fetched over HTTPS, these applications are packaged into Web Bundles, signed by their developer, and distributed to end-users through one or more of the potential methods described in the explainer.

Blink component

UI>Browser>WebAppInstalls>Isolated (component request filed)

Motivation

Content Security Policy (CSP) provides strong protection against cross-site scripting (XSS) vulnerabilities. Transport Layer Security (TLS) and Subresource Integrity (SRI) provide protection against resources being tampered with in transit or when hosted on third-party servers. However, the threat model for some particularly security sensitive applications includes the main application server itself being compromised and serving malicious content. This goes beyond the protections that current policies can provide and requires exploring alternative ways that these applications could be distributed and validated.

TAG review

Not yet filed.

Risks

Interoperability and Compatibility

Gecko: No signal

WebKit: No signal

Web developers: No signals on this proposal but we’ve seen concerned developers looking for solutions in this space. See the explainer for details.

Other signals:

WebView application risks

Does this intent deprecate or change behavior of existing APIs, such that it has potentially high risk for Android WebView-based applications?

As this concept only applies to installed web applications it won’t be available in WebViews.

Debuggability

For the most part all the existing features to support debugability of PWAs and Web Bundles will apply. However, we are considering adding additional diagnostic messages to help developers understand when their application is misbehaving due to the stricter policies.

Is this feature fully tested by web-platform-tests?

No, web application installation is a //chrome concept which can’t be exercised by web-platform-tests. Browser test infrastructure is in isolated_app_test_utils.h.

Flag name

Developers can add an origin to --isolated-app-origins to enable isolation when installing a web app. Eventually this will support a real “developer mode” more similar to how Extensions development works.

Requires code in //chrome?

Yes, while much of the implementation will live in Blink and //content the web app installation infrastructure is implemented in //chrome. 

Estimated milestones

No milestones specified

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/5146307550248960

This intent message was generated by Chrome Platform Status.

Reilly Grant | Software Engineer | rei...@chromium.org | Google Chrome

[Alex Russell]

This is incredibly exciting. Congrats on getting this design to a place where it can be implemented.

[Hyojin Song]

This would be quite required for webOS platform as well, so I proposed https://github.com/WICG/isolated-web-apps/pull/6.

I'm wondering if there is any major consideration or difficulty to be discussed with other stakeholders in this subject.

[Reilly Grant]

The IWA installation infrastructure is not supported on Android, which blocks any of the IWA-only APIs that have been proposed such as Direct Sockets. Supporting Android is not on our near-term roadmap because it will require a different approach to how these apps are discovered and installed by users given the different user expectations on mobile vs. desktop.

Reilly Grant | Software Engineer | rei...@chromium.org | Google Chrome

On Tue, Aug 29, 2023 at 7:03 AM polyset <ry...@polyset.xyz> wrote:

excellent work so far!

we tested IWAs on android chromium 117.0.5x with the following issues:

1) --install-isolated-web-app-from-url and --install-isolated-web-app-from-file did not work (https://bugs.chromium.org/p/chromium/issues/detail?id=1476843)

2) direct-sockets api isn't available on android due to historical reasons mentioned here: https://chromestatus.com/feature/6398297361088512 .  Can we get an update on what those original reasons were? (https://bugs.chromium.org/p/chromium/issues/detail?id=1476852)

3) chrome://web-app-internals did not work on android

about:version attached:

[polyset]

excellent work so far!

we tested IWAs on android chromium 117.0.5x with the following issues:

1) --install-isolated-web-app-from-url and --install-isolated-web-app-from-file did not work (https://bugs.chromium.org/p/chromium/issues/detail?id=1476843)

2) direct-sockets api isn't available on android due to historical reasons mentioned here: https://chromestatus.com/feature/6398297361088512 .  Can we get an update on what those original reasons were? (https://bugs.chromium.org/p/chromium/issues/detail?id=1476852)

3) chrome://web-app-internals did not work on android

about:version attached:

On Monday, April 18, 2022 at 5:48:28 PM UTC-4 rei...@chromium.org wrote:

[Daniel Herr]

 approach to how these apps are discovered and installed by users given the different user expectations on mobile vs. desktop.

What exactly are the these differing expectations?

[polyset]

On Tuesday, August 29, 2023 at 1:22:35 PM UTC-4 rei...@chromium.org wrote:

Supporting Android is not on our near-term roadmap

after digging into the following working-groups: TWA, Payment Handler API, and the Digital Goods API I believe there is a path for IWA on mobile; yet due to security concerns from the community (especially mozilla) it will likely need to be wrapped in a TWA. Unfortunately, when using a devx lens this would be a step backwards. Developers want to develop on a platform freely available to everyone. That platform is the web. When we require them to juggle myriad tools (e.g., trusted-web-activity, bubblewrap, play-store, CustomTabsIntent) to do something simple (i.e., socket()), they will look elsewhere.

I do want to point out the irony of our situation: on mobile, the platform soon to be used by every human on the planet, will not have IWAs! However I do understand and appreciate how we got here and why we don't (or won't) have it. Onward with desktop IWAs!

[polyset]

to add detail: a major chromium implementation with the largest global user base on mobile, *does not support extensions*; behind all of its peers.

given this limitation, it strikes me as very important to get IWA onto chromium / mobile -- although I'm not sure this comment is on-topic as blink isn't opinionated. + I can only imagine the 'Jerry vs Anil' battles happening internally at these organizations. 

so if possible please keep us in the loop on IWA-install / discovery design docs so the community can try to replicate them on mobile -- if there's interest. 

🙏