Re:[minutes] March 22nd meeting

Thanks for the scribe, Dom :)

Sorry I lost my signal in last several minutes.


Regards,
Qing
 ------------------原始邮件 ------------------
发件人:Dominique Hazael-Massieux <dom@w3.org>
日期:Wed Mar 22 16:43:19 2023
收件人:WebView Community Group <public-webview@w3.org>
主题:[minutes] March 22nd meeting
Hi, The minutes of the WebView CG meeting held today (March 22nd) are available at: https://www.w3.org/2023/03/22-webview-minutes.html and copied as text below. WebView CG meeting 22 March 2023 [2]IRC log. [2] https://www.w3.org/2023/03/22-webview-irc Attendees Present Dom, NiklasMerz, QingAn, Rayan, tomayac7 Regrets - Chair - Scribe dom Contents 1. [3]Locally hosted content #2 2. [4]Controlled Frame explainer FYI and review 3. [5]AOB Meeting minutes [6]Controlled Frame explainer FYI and review #3 [6] https://github.com/WebView-CG/explainers/issues/3 [7]Locally hosted content #2 [7] https://github.com/NiklasMerz/explainer-webview-local-content Niklas: this is a proposal to find a common denominator across webviews to expose local content to WebViews - based on what's in iOS and Android … right now, the different implementations have different limitations, different choices (e.g. origins) … having a single API would benefit developers Rayan: seen feedback; most of it around origins [8]Discussions around the explainer [8] https://github.com/NiklasMerz/explainer-webview-local-content/discussions/4 Rayan: how would the app affect the origin? would app Foo be a different origin from app Bar? … [9]myapp://foo vs [10]mapp://bar [9] myapp://foo/ [10] mapp://bar/ Niklas: they would be different origins Rayan: Android today treat these as different origins Niklas: OK, so it's worth clarifying in the explainer Rayan: there is also ongoing work to standardize custom schemes [11]Intent to Ship: Support URLs with non-special schemes [11] https://groups.google.com/a/chromium.org/g/blink-dev/c/wYuPrIQzDTA Rayan: there seems to be alignment with GeckoView and Webkit behind this proposal Rayan: assuming there is convergence, does that affect your preference on option 1 vs option 2? Niklas: not really; with HTTPS, you can use CSP / CORS and get more Web foo Rayan: a lot of the considerations also need to take into account how Web site to work; at the moment with custom schemes, CSP / CORS will break … that's an important consideration for this API … my hesitation with HTTPS, it doesn't feel right to use it to serve your own content dom: I wonder if we could use a magic HTTPS origin à la localhost Rayan: what happens if you have a custom scheme and want to load resources? do you rely on the interception API? Niklas: in iOS, any request on that custom scheme gets intercepted (usually a simple mapping to the filesystem) Rayan: any impact on performance / latency? Niklas: this hasn't been an issue in the apps I've worked on Dom: where would we go next after we converge on these discussions? Rayan: there is interest on Android WebView once there is more clarity on https vs custom schemes … Andy from the Windows webview is also participating in the discussions Niklas: I'll ping my contacts on WebKit webviews [12]Controlled Frame explainer FYI and review [12] https://github.com/WebView-CG/explainers/issues/3 Rayan: this is a WebView for the Web … different fenced iframe, only available for isolated web apps … it comes with guarantees - it runs outside of the context of the embedding web app, works as if it was a top level context … there is exploration to provide WebView-like APIs to control web content … hence the intersection with our CG [13]Controlled Frame explainer [13] https://github.com/chasephillips/controlled-frame/blob/main/EXPLAINER.md Rayan: they're seeking feedback on the explainer from the CG Qing: this is only for isolated web apps - not for hybrid apps? Rayan: correct - it wouldn't work on any web site … only for isolated web apps where resources are packaged in a web bundle Niklas: I used to work on a Web app that used iframes extensively for a widget system … it would be cool to have full control over the embedded pages when combine frames in your main app … I need to get a better understanding of isolated web apps Rayan: the explainer details how it differs from iframes and why it is necessary AOB Rayan: there is ongoing work on a device attestation API - which is particularly useful for WebViews … e.g. a banking app wanting to ensure they're running on a non-compromised device … it relies on a trusted source that gives signed tokens on whether the device has been root, whether the app is trusted, etc … expect an explainer coming in this space to the CG Dom: may be worth surfacing that use case in our usage doc Rayan: note that this would be a Web Platform feature, not just for WebViews - it has utility in anti-fraud contexts … but let's wait to see the explainer when we can react with a more detailed proposal Niklas: looking forward to this, in particular a clearer sense of the use cases Minutes manually created (not a transcript), formatted by [14]scribe.perl version 210 (Wed Jan 11 19:21:32 2023 UTC).