3 ms·

Do you want to cripple the entire app industry? Apps built using React Nativ / Flutter e.t.c use the WebView to render themselves. So they’re basically already

Do you want to cripple the entire app industry? Apps built using React Nativ / Flutter e.t.c use the WebView to render themselves. So they’re basically already running “in-app browsers” But then how do you differentiate when the app is rendering its own view rather than another website? You could apply some restrictions like <iFrame> has nowadays where you need extra security privileges (I think) to render pages / execute scripts not on the same domain Otherwise you can always open safari from all of these in-app browser views and they could implement a toggle which forces all of them to be opened in Safari automatically

supermatt 4y ago
Thats not how react native or flutter work at all. They use native views, not a browser. You are likely thinking of cordova (phonegap) et al.
- navanchauhan 4y ago
  oh damn! I just went and looked into depth and indeed my knowledge was wrong. Well, TIL Honestly it is pretty fascinating how these cross-platform frameworks work.
rullelito 4y ago
It's a big difference between browsing your own pages in-app, and opening any link in an in-app browser and tracking it.
- navanchauhan 4y ago
  I am not defending the practice. Maybe, Apple can addd it in their app store policy
joshu 4y ago
it’s a bad experience for opening external links. i don’t care that it’s not easy to get to. and no, not all apps do this. tiktok does not offer an escape, and instagram hides it behind two clicks.
- navanchauhan 4y ago
  Huh, TikTok is one of the first apps I have seen which do not allow you to open an external website in Safari. I am going to do a bit more research and try to find other apps that do the same
joshstrange 4y ago
I think the clear answer is to only allow local/whitelisted domains that you can prove you own. I work on Capacitor/Cordova apps regularly and only allowing local code would allow for them to continue to work and close this loophole. Anytime I open an external page I do it in SFSafariViewController which doesn't have the ability to inject code or snoop.
- navanchauhan 4y ago
  That sounds like a plausible solution

supermatt 4y ago

Thats not how react native or flutter work at all. They use native views, not a browser. You are likely thinking of cordova (phonegap) et al.

navanchauhan 4y ago
oh damn! I just went and looked into depth and indeed my knowledge was wrong. Well, TIL Honestly it is pretty fascinating how these cross-platform frameworks work.

rullelito 4y ago

It's a big difference between browsing your own pages in-app, and opening any link in an in-app browser and tracking it.

navanchauhan 4y ago
I am not defending the practice. Maybe, Apple can addd it in their app store policy

joshu 4y ago

it’s a bad experience for opening external links. i don’t care that it’s not easy to get to. and no, not all apps do this. tiktok does not offer an escape, and instagram hides it behind two clicks.

navanchauhan 4y ago
Huh, TikTok is one of the first apps I have seen which do not allow you to open an external website in Safari. I am going to do a bit more research and try to find other apps that do the same

joshstrange 4y ago

I think the clear answer is to only allow local/whitelisted domains that you can prove you own. I work on Capacitor/Cordova apps regularly and only allowing local code would allow for them to continue to work and close this loophole. Anytime I open an external page I do it in SFSafariViewController which doesn't have the ability to inject code or snoop.

navanchauhan 4y ago
That sounds like a plausible solution