W3C Proposes the Creation of a WebView Community Group

Interesting. As someone using webviews extensively[1], the main issue is that the "iframe" model of security many operate on makes sense on the web, but not in native apps. When it comes to embedding third party content with iframes, you essentially want two-way security and privacy. The embedder can't change things in the embedded and vice versa.

With webviews however, that model doesn't make much sense: the embedder is controlling the webview and frequently needs to apply or enrich the embedded view. Browsers (which by and large maintain these webview APIs) have no incentive to stray from the web model of security though: they have no use for it themselves and it creates new vectors for security breaches in them. So I wonder how much a community group can affect.

[1] I build a browser for devs which uses webviews, https://polypane.app

Looks like this has already been created, back in March?

Here's their charter: https://github.com/WebView-CG/charter/blob/main/charter.md

This reminds me, back when I used to do app security, one of the issues with webviews was that some apps would hide much of the UI that users are used to seeing in browsers to make security decisions. So if an attacker could, via some vulnerability, redirect the site being viewed in the webview to one of their choosing, the user wouldn't be any the wiser.

I think it would generally be better if webviews, by default, have restricted navigation, and the developer has to deliberately whitelist domains they wish to view in it. Rather than having to write a navigation delegate or similar to implement their own whitelist, which most developers won't bother with.

"WebView" in software should be preferred over electron, but why it's not the case today?

Because it is bloated, more complicated, and require an insane amount of preparation to get started in a cross-platform fashion, specially for windows: https://docs.microsoft.com/en-us/microsoft-edge/webview2/get...

Then you understand why nobody wants to deal with that stuff and choose lowest common denominator (electron)

Just look at what you have to do to get started with WebView2 on windows

Hopefully this community group will lead to a better story for webviews in desktop software

Very interesting. As one of the maintainer of Cordova I am looking forward to see what happens there.

For context, Instagram, TikTok and Facebook embedded browsers have bigger shares of market than many major browsers. A LOT of web is being consumed in those WebViews. There is also WeChat that is an entire universe of WebViews.

I wonder if this will actually happen, since most webviews are closed source and the work of big corporations? Maybe people like the Electron maintainers can get involved.

yeah tauri is some progress and flutter webview is also is ok if you only care about ios and android but its not enough.

https://github.com/tauri-apps/tauri

The major issue is that there is no cross-platform webview currently. The main candidate is the official webview shipped on windows, but it is currently lacking linux support https://github.com/MicrosoftEdge/WebView2Feedback/issues/645... Linux webviews like e.g. tauri are shit, they use webkit wich leads to platform specific bugs and limitations vs the tauri on windows and more importantly webkit is the new IE, it lacks so many features it's pathetic and has major performance issues, e.g. https://www.phoronix.com/scan.php?page=news_item&px=WebKit-W... Why can't linux distros get an official chromium webview is beyond me, and those are the same shills that continuously rant about Electron bloat..