4 ms·
As others have already mentioned, one needs to distinguish between WebViews and "in-app native browsers" / browser overlays (SFSafariViewController on iOS, Cust
by codethief 4y ago
As others have already mentioned, one needs to distinguish between WebViews and "in-app native browsers" / browser overlays (SFSafariViewController on iOS, CustomTab on Android). While WebViews are bad for all the reasons mentioned in the article, overlays do serve a purpose:
- The app gets notified when the website gets closed.
- The app is hidden underneath the overlay while the website is open. That is, the overlay is tied to the app and the user can't get lost or switch back to the app before they haven't closed the website.
All these are important, e.g., for OAuth, 2FA and payment-related applications.
Overlays are also way less bad than WebViews in terms of:
- UX: The overlay uses the cookies and settings of the native browser, looks familiar, and uses an up-to-date browser engine.
- Security for the host app: The website runs in a separate process
- Security for the user: They can see the URL and be (relatively) certain that the host app doesn't have access to the website and their interaction with it (i.e. no key logging).
So while I'd support busting out of WebViews (especially when they're opening paypal.com), I'm not so sure about overlays.