Manifest: Install button on another domain

[photopea]

In the future, somebody would want to create a "market for webapps", justl like an App Store / Google Play / Ubuntu Store thing. App / Game authors would probably submit the Manifest (or a link to it) to these websites. It would be nice, if these markets could have the "Install" button, that will add an icon to your homescreen (directly, without going to a website of the author).

What would be the mechanism of having such Install button in terms of the current specification?

Let's expect, that the "Market" already has a trust from the user (it could be the market from Google or Microsoft, installing from other places would be just as "dangerous", as downloading EXEs / APKs outside the market today). The user also trusts, that the market service has verified the origins and maintainers of the app properly (so nobody spreads their app as "Facebook", just by having the name "Facebook" and the icon).

[nuxodin]

Classically there would be an api like:

navigator.permissions.query({name:'appBroaker'}).then(function(result) {
    if (result.state == 'prompt') {
         navigator.appBroaker.add('https://link.to.manifest.json', {options});
    }
});

And then a security prompt like "Do you really want to allow this website to install foreign apps?"

In order to realize such an interface, one must consider which authorizations are granted with it.
For example you can:

• Install a serviceworker.
• Install a fullscreen app.

Perhaps people are not sufficiently familiar with PWAs...

I would very much welcome such an interface, but i don't think players like google, apple and microsoft are willing to risk people getting lost to other webstores. :(

[photopea]

@nuxodin I think, that giving the "market website" a special permission to install apps makes no sense. The browser will prompt the user "Do wou want to install this app to your homescreen" anyway, which means, that the user really wants it. There is no need to say it twice.

[mgiuca]

I think in principle having an API to install another manifest (essentially, similar to beforeinstallprompt, allowing you to trigger an app install prompt, but for a different origin's manifest) is OK. It would be consistent with the values of the web for browsers to allow third-party "broker" sites to install other apps.

We'd have to be very careful from a security standpoint that you are not being spoofed. For a start, that means the install dialogs would need to show (in a browser-controlled way) the origin of the site being installed.

The browser will prompt the user "Do wou want to install this app to your homescreen" anyway, which means, that the user really wants it. There is no need to say it twice.

That's somewhat reasonable, but I would possibly want some defense-in-depth here and also require the user to accept a permission to install sites. Otherwise any site could suddenly start popping up prompts to install malicious web apps.

[aeallord]

So the concept here is to give more openings for attackers to deliver attacks to users? Someone would need to layout the security model for this in great detail. Current generalization of security is looking like a again for PWA developers but could turn in to a major loss for the average consumer.

[marcoscaceres]

Closing as out of scope of the current work.

[photopea]

There is an attempt of a PWA store here: https://progressiveapp.store/ . They do not have an install button. The only thing they can do is to open the website of the PWA. Then, the user should hope the default PWA installing will be triggered. If the "beforeinstallprompt" is used, the user has to spend a lot of time to find a custom Install button in the UI of the webapp (which can be at a different location for each webapp).

What about the custom URL address:

<a href="install:www.Instagram.com">Install Instagram</a>

After clicking such link, the browser checks, if there is a manifest and a PWA installable at that link, and shows a prompt for installing the PWA without even going to that site. Abusing it is no more dangerous than abusing window.confirm() and browsers know how to handle it.

[nuxodin]

Such an API is discussed here again:
https://github.com/PEConn/web-install-explainer