4 ms·
I like the general idea a lot: let sites say whether they're willing to be displayed this way. But two main disagreements: * We can't reuse X-Frame-Options for
by jefftk 4y ago
I like the general idea a lot: let sites say whether they're willing to be displayed this way. But two main disagreements:
* We can't reuse X-Frame-Options for this, because sites are already setting that without necessarily wanting to opt out of in-app browsers.
* I do think Apple and Google might be persuaded to require all IABs to respect this "I want my site to open in the user's default browser" directive, as an app store approval requirement. For example, their account security teams would likely be strongly in favor.
I do think Android's Custom Tabs and iOS' SFSafariViewController should still be allowed, however, since the embedding app can't exfiltrate site data, inject JS, etc.
- sriku 4y agoI think non-platform browsers also use the same engine and webview, so if the platform implements "honor X-Frame-Options", won't it essentially lock out third party browsers? Like I won't be able to use Firefox Focus. Maybe the app review process can catch this behaviour instead? ... That way, it can be permitted for browsers but not for apps with embed a webview? That might work for iOS where reviews are strict, but no idea whether it would on Android.
- jefftk 4y agoYes, I think actual browsers should be allowed to do nothing when seeing it. Strongly against anything that would make it harder to use Firefox. My understanding is that both app stores already have a concept of "this is a web browser" vs "this is an app that includes an in-app browser" and so this is pretty practical?