search

WebView-CG / usage-and-challenges

Documenting usage scenarios for WebView and the challenges they create
https://webview-cg.github.io/usage-and-challenges/
Other
12 stars 4 forks source link

WebView security model vs same-origin policy #31

Closed muodov closed 2 years ago

muodov commented 2 years ago

There's been a few conversations where security concerns were raised (1, 2, 3, 4, 5)

In particular, there seems to be a recurring question about whether same-origin policy should apply to the native context. Shall we discuss different perspectives here?

rayankans commented 2 years ago

Thanks for bringing this up @muodov!

Access to cross-origin/3P web content (i.e web content that is not owned by the host application) can have serious security/privacy implications (example).

I think it makes sense to follow the web's security model here, since the web was designed to be composable through the use of iframes. Embedding web content in a native app can be thought of in the same way as having an iframe on your website, where the native app is the top-level context and the WebView is the iframe. The web contents of an iframe are only accessible if it's a same-origin (which would map to being a 1P web page in the world of WebViews).

However, this model would also block some valid use cases, like #4 (Building opinionated browsers). My thinking is that same-origin policies should be applied to WebViews, unless an app declares itself to be a browser (receives special browser permissions), or involves some form of user consent (similar to the extensions topic which came up in previous CG meetings; extensions allow an elevated level of control over web content, however they are explicitly installed by users).

I'd love to hear more from people who build hybrid apps & modify 3P web content, since this doesn't technically fall under the "building a browser" scenario.

muodov commented 2 years ago

@rayankans @aluhrs13 https://github.com/WebView-CG/usage-and-challenges/issues/36 looks like an expanded version of the same problem. Should we close this issue and continue discussion there?

QingAn commented 2 years ago

36 looks like an expanded version of the same problem. Should we close this issue and continue discussion there?

@muodov As discussed in 2022-08-23 meeting, it is suggested to split into several specific use cases and then maybe we can choose to close this issue.

muodov commented 2 years ago

Closing this as the conversation continues in #36