cross-application communication APIs

[sashafirsov]

The ticket is about exploring available now, currently used and potential alternatives. EPA-WG is given for reference for such kind of cross-app communication API use.

Available in browser

• window.postMessage
• window.localStorage
• document.cookie
• direct src/href attribute set on IFRAME or similar element (object, embed, etc).
• location="javascript:..."
• shared data island.
• clipboard
• push API
• ?

Criteria for evaluation

• could pass data,
• data as object , need for serialization/marshalling
• data size limit
• sync/async nature of data transfer
• ability to broadcast data to multiple apps
• availability to pass data independent from app presence on host page
• availability of data change notification API
• security and scope limitation

purpose of cross-application data storage and communication

• friendup - TBD
• EPA
  • control the application views and
  • defines the set applications of same scope
  • persist the common data set for apps disregarding of their life cycle and presentation state, including offline
  • notification of data change as one of ways to sync different apps state, exchange messages, etc.

API matrix with criteria

since actual 2d matrix UI in github is not that flexible and most of bullet points would require extended elaboration, the matrix format actually a list of each criteria against each API entry.

window.postMessage

• ✔ could pass data
• ✔ data as object , need for serialization/marshalling serialized using the structured clone algorithm by browser.
• ✔ data size limit not set
• ✔! sync/async nature of data transfer. browser executes synchronously, event based dispatch cross-frame. Potential deadlock for cross-frame.
• ❌ ability to broadcast data to multiple apps targetWindow** prevents broadcasting
• ❌ availability to pass data independent from app presence on host page
• ✔ availability of data change notification API
• ✔! security and scope limitation targetOrigin** limits messaging to defined URL, domain only is not supported preventing vendor to change/upgrade API

transfer useful helper allowing pass object ownership to destination.

window.localStorage

• ✔ could pass data
• ✔! data as object , need for serialization/marshalling provides key:value string pair. To use more complex objects needs serialization , usually JSON in sender/receiver code.
• ✔ data size limit not set
• ✔ sync/async nature of data transfer. asynchronous, event based cross-frame notification.
• ✔ ability to broadcast data to multiple apps, cross-frame.
• ✔ availability to pass data independent from app presence on host page
• ✔ availability of data change notification API
• ✔ security and scope limitation. Domain based.

document.cookie

• ✔ could pass data
• ✔! data as object , need for serialization/marshalling provides API to set key:value string pair. Getter requires parser, to use more complex objects needs serialization , usually JSON in sender/receiver code.
• ❌ data size limit up to 4K. Due to high level use especially for authorization, it is not advised to store variable size data.
• ✔ sync/async nature of data transfer. synchronous. Server and client side.
• ❌ ability to broadcast data to multiple apps.
• ✔ availability to pass data independent from app presence on host page
• ❌ availability of data change notification API
• ✔ security and scope limitation. Domain and sub-domain based insulation. Artificial Insulation layer for URL.

APIs support

EPA

embed-page is targeting to cover most of provided APIs and certainly the most popular among in-browser front-end frameworks. sessionStorage and localStorage implementation is ready; location.href is implemented without target attribute( app could not control another ), cookies are next on implementation.

friendup

Utilizes postMessage for cross- container communication. The data and events for application itself TBD.

CC: @thomaswollburg , @francois333 , @titlestad

[sashafirsov]

Just realized what is common ground of friendup and EPA. EPA is a runtime for running PWA applications on friendup desktop.

[titlestad]

We actually enabled cross app messaging in one of the previous releases. Postmessage is working very well.

What specific use case would we solve with this? PWA? How?

[sasha-firsov-bs]

PostMessage is just one of multiple APIs for cross-app communication. EPA tries to cover all starting with most popular. It also introduces the scope for groups of apps where those APIs could communicate through. The insulation allows to use existing apps without worry of cross-browser pages penetration. I.e. two persons windows using same app would not share scope unless instructed by container.

When you stated support for PostMessage I guess it was referencing to custom protocol requiring utilizing FriendOS conventions by app. In EPA app does not need to know about container and can use any communication api on it's own judgement according to w3c standards.

PWA are standalone apps loaded into OS. Not much popular but have a good support as it is cross-platform solution. If I would select own desktop/os, it would be one of platforms important to support as it fits to the concept perfectly. (Second would be java and android as remote terminal support you already have). PWA as browser-based apps could run in RDP terminal of course but also could run locally in same browser. The missing part for FriendOS is virtualization of environment where it runs. EPA could give that layer. PWA has all necessary attributes of application: icons, title, vendor credentials, security layer, window control,... and most important open cross-platform support. When running in desktop environment all should be kept in place and exposed properly to user. EPA could provide the integration and insulation layer as for web apps as for PWA within friendos desktop browser page.

[xet7]

Wekan has PWA apps at:

• Android Play Store, created with https://pwabuilder.com and and https://play.google.com/console
• Win10 desktop MS Store, created with https://www.pwabuilder.com and https://partner.microsoft.com
• Ubuntu Touch OpenStore, source code at https://github.com/wekan/wekan-openstore, it's possible to test Ubuntu Touch on RasPi3.

Android Play Store and MS Store do cost about 30-50 euro/year each. Ubuntu Touch OpenStore is free.

Please note that:

• Google seems to request simplified details about usage of Google login at https://console.cloud.google.com , and often there are new requirements to add info about, or new details to be filled to manifest at https://pwabuilder.com
• When submitting apps, it's better to create ready made test account for MS Store, if registering does not work well.
• Apple has very actively removed very many PWA like apps (and app generator like apps) from App Store, suggesting that those would be better as used with mobile webbrowser. It's not anymore possible to create PWA app for Apple App Store at https://pwabuilder.com . Apple has been adding some PWA features to Safari webbrowser.
• Not-working PWA features has been removed from Firefox. Meanwhile, Firefox has killer app extensions like Multi-Account Containers etc, so I prefer Firefox.
• Propietary Chrome browser bookmark etc sync has been removed from Open Source Chromium https://news.ycombinator.com/item?id=25886218 and there is some discussion about not packaging Chromium for some distros.

More info about Wekan PWA:

• Wekan PWA manifest, icons etc at: https://github.com/wekan/wekan/tree/master/public
• Wekan Roadmap card: Mobile apps
• Installing PWA as app icon using some webbrowser

[titlestad]

We have cross communication implemented now via application to application messaging. Check the developer manual on this. :)