jmajnert
commented
10 years ago A lot here depends on whether the Browser and the Runtime are the same application. In fact in Tizen these are two separate beasts, which makes it impossible to do what you wrote in the third bullet. Please also remember that a user can install a third party browser that:
- may have no knowledge of which sysapps are installed
- may not support SysApps specs (APIs, execution model etc)
In this particular scenario (a browser is navigated to a webpage that is part of an installed sysapp) I would expect that the browser, if it has knowledge of the installed sysapps, renders the webpage normally and informs the user that they have this webpage installed as a sysapp. Additional trust gained from being installed should not be granted in the browser, IMHO.
opoto
Once a system application has been installed, the specification does not specify if this application can be executed in a usual browser, or if it needs a dedicated UA. This question has been raised on the mailing list (http://lists.w3.org/Archives/Public/public-sysapps/2013Jul/0019.html), and answers suggest that this is missing from/should be added to the spec.
The situation can occur for both hosted and packaged applications: what happens when a user, while navigating in her usual browser, clicks on a link that belongs to an installed sys app? Or is redirected to such link? A new section could be introduced in the spec, eg “7. Execution Context” (after “Data isolation”), or alternatively it can be added to the existing “7. Navigation”.
It should be possible to continue the navigation in the same UA (the regular browser) in order to:
If this is the behavior we agree on, the following text can be used (amended and complemented as needed): “When the user, while navigating with her regular UA browser, opens a page or iframe which URL belongs to an installed system application, the UA sets the execution context of this page or iframe so that the data isolation and trust model of this installed system application applies. In particular, the permissions associated to the installed application will be granted to this page or iframe. As soon as the navigation closes or leaves a page or iframe of an installed application, the UA terminates the associated execution context, and sets a new context suiting the new navigation URL, if any.”
We could also add a recommendation or non normative text suggesting that UA visually notify that context has been switched to an installed sys app. This could be rendered similarly to the https/ssl indicator currently used in browsers.