Open muodov opened 1 year ago
The last two concerns (webcompat issues and malicious apps) deserve their own threads IMO, as they sound more like WebView deficiencies rather than something a web app might choose or not.
The solution proposed in the article is to respect X-Frame-Options: deny
, and load the page in the "user's preferred browser". I see a few problems with that:
frame-ancestors
with specific list of origins, but native apps have no "origins" at the moment: https://github.com/WebView-CG/usage-and-challenges/issues/42The solution proposed in the article is to respect
X-Frame-Options: deny
, and load the page in the "user's preferred browser" [ ... ]
Just to have it mentioned here, Alex Russel proposed using a new CSP frame-ancestors
value in his Hobson's browser post:
Content-Security-Policy: \
frame-ancestors 'system-default';
Upsides compared to X-Frame-Options
:
X-Frame-Options
is deprecated in favor of frame-ancestors
anyway<meta />
tag, not just headersPresumably this opt-out needs to be provided in a way that the Application can not just arbitrarily override. That will probably require putting some webview capabilities behind app store permissions to at least make them explicit.
Anything that can intercept requests or set the HTML content of the webview directly fall into that bucket but it's probably also worth getting some security experts to weigh in.
Ability to configure proxies or app-level VPN and client trust roots (combined allow for arbitrary interception) probably fall into the bucket as well.
Thanks for creating an issue on this. (I'm the guy who had surfaced the concerns in the aforementioned article.)
In my particular business case for Soundslice, I do indeed want to be able to embed the Soundslice website within condoned native apps — on a case-by-case basis that I control.
Also, for the record, although I suggested X-Frame-Options
, I'm by no means married to that solution.
This issue was initially raised in https://github.com/WebView-CG/usage-and-challenges/issues/36
There is a case to be made that web pages should have a way to opt-out from being rendered in a WebView, similar to how they can forbid iframe embeds. @adrianholovaty surfaced some concerns in Let websites framebust out of native apps: