related_applications is single engine feature

[marcoscaceres]

The related_applications member of this specification currently only has a single implementation. As such, it has been marked "at risk" as per the W3C Process, meaning that:

[The feature] may be removed before advancement to Proposed Recommendation without a requirement to publish a new Candidate Recommendation.

The Web Apps Working Group is seeking a second implementation in order to keep this feature in the specification.

[sunggook]

Windows already supported it quite a while in addition to Android, and 'webapp' platform for all dPWA is under issue tracker; https://bugs.chromium.org/p/chromium/issues/detail?id=1114966

[marcoscaceres]

Thanks @sunggook for the link and additional implementation information. We are still looking for a second browser engine to support it.

[jfrazzano]

Why is there resistance to implementation. It would seem natural for a progressive/micro-service weighted platform to encourage if not insist on loose coupling of related apps.

[christianliebel]

Considering this feature has remained single-engine, I would suggest moving it to Manifest App Info.

@marcoscaceres @dmurph @diekus @kenchris Any objections?

[dmurph]

Only objection is that it wouldn't go to the web app info area, it would go to manifest_incubations under WICG (the other is a mini app thing).

Unless I'm missing something.

[iinuwa]

There is work to implement a FIDO2/WebAuthn API for Linux (akin to Windows Hello), and in order to implement that properly, we need to bind application IDs to origins. The related_applications field is just the thing we would need. I'm not sure if it's too late to keep this, or whether this sort of implementation would count for keeping this in the spec.

[christianliebel]

@iinuwa My understanding is that we require at least two of the Chromium, Gecko, or WebKit engines to implement a feature. However, you can continue to use the related_applications field if it is helpful for you. It simply moved over to Manifest Incubations (related_applications) at WICG. This change is required for our specification to advance on the recommendations track.

[iinuwa]

Got it, thanks! We'll take that into consideration as we implement this. We would need to extend it with a new platform, and we will require at least one more piece of information: an explicit permission given by the origin/domain owner to allow the related application to use credentials for that domain, perhaps in a new permissions key under the related_applications objects. If we do use this, we'll reach out for any recommendations regarding extensions. Thanks!