Isolated Web Apps

[MzHub]

Code sample

No response

MDN URL:

No response

Specification URL:

https://github.com/WICG/isolated-web-apps

Any other links?

https://chromestatus.com/feature/5146307550248960

How stable is this feature?

Future (No implementations yet)

Type of feature

Other

What focus area does this feature fall under?

Security & Privacy, Bridging the gap with native

Details

Isolated Web Apps is related to Subresource Integrity and PWA manifest. It provides a missing security layer that native apps have, which is signed updates to the app. A notable example is Signal's refusal to implement a web version of their app due to this missing piece. It would be interesting to see if other developers also avoid building web apps due to this.

[LeaVerou]

Is there a code snippet that shows how this works? I could not figure it out from the explainer.

[MzHub]

I have to admit I'm not deeply familiar with the explainer, but here are code-adjacent snippets, if it helps at all.

From isolated-app scheme explainer:

isolated-app://signed-web-bundle-id/path/inside/app.js?some-query#foo
^           ://^                   /^                 ?^         #^
scheme         opaque host          path               query      fragment

The proposal is that isolated apps could be delivered as Web Bundles, which are "bundled up groups of HTTP responses". I'm not sure on the details further than that.

---

From updates manifest explainer:

{
  "versions": [
    {
      "version": "5.2.17",
      "src": "https://cdn.example.com/app-package-5.2.17.swbn"
    },
    {
      "version": "6.1.13",
      "src": "v6.1.13/package.swbn"
    },
    {
      "version": "7.0.6",
      "src": "v7.0.6/package.swbn"
    }
  ] 
}

An example of the proposed new manifest file to handle updates to the isolated app.

---

From permissions explainer:

"permissions_policy": {
   "geolocation": [ "self", "https://map.example.com" ],
   "fullscreen": [ "*" ]
}

Explicit permissions similar to how apps work on mobile. To give users more awareness and control.

---

Sorry for lack of material here, I come at this more from wanting a solution, although I do not fully understand the solution.

For context, there are some efforts at solving this from different direction, for example there is SecureBookmarks, which attempts to solve the "can't trust the server"-issue by placing a subresource integrity hash inside a bookmark. A malicious server can not change the user's bookmark, so it is a safe starting point for the app.

Then there's Signed Pages which attempts to solve this, or at least similar issues, via a browser extension.

[LeaVerou]

Thanks! I was more looking for a 1-3 line snippet to include in the question. Maybe an isolated-app:// URL?

[MzHub]

Closest I can find to "how it works in practice right now" is this https://github.com/GoogleChromeLabs/telnet-client/

npm run start

google-chrome-unstable --enable-features=IsolatedWebApps,IsolatedWebAppDevMode \
                       --install-isolated-web-app-from-url=http://localhost:8080

or

npm run build

google-chrome-unstable --enable-features=IsolatedWebApps,IsolatedWebAppDevMode \
                       --install-isolated-web-app-from-file=$PWD/dist/telnet.swbn

[MzHub]

I still don't have a suitable code snippet for the survey, but I have a suggestion for the short explanation text, in case there isn't one yet.

This is based on the text from Isolated Web Apps Chrome Platform Status overview, which I think is good, but a bit long for the survey.

The overview reads:

Isolated Web Apps (IWAs) are an extension of existing work on PWA installation and Web Packaging that provide stronger protections against server compromise and other tampering that is necessary for developers of security-sensitive applications.

Rather than being hosted on live web servers and fetched over HTTPS, these applications are packaged into Web Bundles, signed by their developer, and distributed to end-users through one or more of the potential methods described in the explainer.

I would suggest for the survey:

Native-like packaging, permissions and signed updates for PWAs.

or

Native-like packaging, permissions and secure updates for PWAs.

---

Maybe you're right that out of not-so-good options the isolated-app url is a best snippet to at least illustrate that they're not server hosted.

isolated-app://4tkrnsmftl4ggvvdkfth3piainqragus2qbhf7rlz2a3wo3rh4wqaaic/index.html

(I think in reality the index.html part probably isn't there, it's just / as that is usually the start_url in the PWA manifest, but the main file in the IWA demo app is index.html)

[LeaVerou]

This is very useful, thanks!