From e1f0df0504b850da21c77603f28e2857f19cda71 Mon Sep 17 00:00:00 2001 From: Jeffrey Yasskin Date: Wed, 27 Aug 2025 23:19:29 +0000 Subject: [PATCH 1/4] Describe how pieces of an application can be user agents. An application might not act as a UA when browsing 1p content, as long as the distinction is clear to users. A library might or might not implement the UA duties, depending on the purpose it's meant to serve in applications that embed it. --- index.bs | 47 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-) diff --git a/index.bs b/index.bs index dc54d79..b8e1e7a 100644 --- a/index.bs +++ b/index.bs @@ -48,6 +48,50 @@ user agents choose which specifications to implement in order to best serve thei and they implement proprietary user interfaces and other behavior around the specifications they do implement. +## User agents as software components ## {#ua-as-software} + +As software entities, user agents can be parts of larger applications, +and they can call libraries that implement the web platform or parts of it. + +If the user of an application +can distinguish the user agent inside that application +from other parts of the application +that act on the application's author's behalf +("first-party" parts of the application), +then only the [=user agent=] parts, +which browse "third-party" content, +need to follow the [=user agent duties=]. +Applications with embedded user agents should +give their users clear expectations about +what behavior they should expect from different parts of the app. +If the distinction between third-party and first-party content is too small, +the application should also follow the [=user agent duties=] +for its first-party content. + +Similarly a library that implements the web platform +may or may not be a full [=user agent=]. +Some, like [`SFSafariViewController`](https://developer.apple.com/documentation/safariservices/sfsafariviewcontroller) +and [Android Custom Tabs](https://developer.chrome.com/docs/android/custom-tabs) +take the responsibility of implementing the [=user agent duties=] +and of making a clear distinction between the third-party content they browse +and the first-party content controlled by the embedded application. +These libraries are [=user agents=]. + +Other libraries, like the +[Android](https://developer.android.com/reference/android/webkit/WebView), +[iOS](https://developer.apple.com/documentation/webkit/wkwebview), +and [Windows](https://developer.microsoft.com/en-us/Microsoft-edge/webview2/) +WebView libraries, +are designed to support many kinds of applications. +Because some of these applications only include first-party content, +WebView libraries aren't meant to be [=user agents=] on their own, +and they don't implement the [=user agent duties=]. + +Ultimately, an embedding application is responsible for ensuring +that it follows the [=user agent duties=] if it or part of it is a [=user agent=]. +This can be nearly trivial if it only browses third-party content using a [=user agent=] library. +Developers need to take more care +when implementing an in-app browser using a non-[=user agent=] WebView. # How the ecosystem works # {#ecosystem} @@ -71,7 +115,8 @@ fast enough to prevent the culture-loss from spreading. Each user agent serves its user ([[!RFC8890 inline]]), not any of the other constituencies. -A user agent owes its user various duties, +A user agent owes its user various +duties, which should be established through collective discussions and embodied in the various standards that user agents implement. From 458f56174178314dac19da0793ceecea5467956f Mon Sep 17 00:00:00 2001 From: Jeffrey Yasskin Date: Wed, 17 Sep 2025 07:30:57 +0000 Subject: [PATCH 2/4] Try to be clearer/shorter about what allows an app to treat only part of itself as a UA. --- index.bs | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/index.bs b/index.bs index b8e1e7a..96a93a4 100644 --- a/index.bs +++ b/index.bs @@ -53,16 +53,15 @@ around the specifications they do implement. As software entities, user agents can be parts of larger applications, and they can call libraries that implement the web platform or parts of it. -If the user of an application -can distinguish the user agent inside that application -from other parts of the application -that act on the application's author's behalf -("first-party" parts of the application), +If an overall application makes a clear distinction +between its pieces that are [=user agents=] and its pieces that aren't, then only the [=user agent=] parts, which browse "third-party" content, need to follow the [=user agent duties=]. -Applications with embedded user agents should -give their users clear expectations about +Parts that are clearly only showing the application's own content +can act on their own behalf, +but the application should still +give its users clear expectations about what behavior they should expect from different parts of the app. If the distinction between third-party and first-party content is too small, the application should also follow the [=user agent duties=] From f283e29848e968a6000fd19dcbf07f224f8069f9 Mon Sep 17 00:00:00 2001 From: Jeffrey Yasskin Date: Wed, 17 Sep 2025 07:35:48 +0000 Subject: [PATCH 3/4] Be clearer that applications need to work to follow the Duties when using WebViews to browse 3p content. --- index.bs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/index.bs b/index.bs index 96a93a4..490b884 100644 --- a/index.bs +++ b/index.bs @@ -89,7 +89,8 @@ and they don't implement the [=user agent duties=]. Ultimately, an embedding application is responsible for ensuring that it follows the [=user agent duties=] if it or part of it is a [=user agent=]. This can be nearly trivial if it only browses third-party content using a [=user agent=] library. -Developers need to take more care +Developers need to take extra care +to follow the [=user agent duties=] when implementing an in-app browser using a non-[=user agent=] WebView. # How the ecosystem works # {#ecosystem} From 8bdbffe7cce7836c5d4b2a92dec6dcbd1dac9799 Mon Sep 17 00:00:00 2001 From: Jeffrey Yasskin Date: Wed, 17 Sep 2025 07:41:55 +0000 Subject: [PATCH 4/4] Add an address bar example for confusing 3p and 1p content. --- index.bs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/index.bs b/index.bs index 490b884..16a98cb 100644 --- a/index.bs +++ b/index.bs @@ -66,6 +66,10 @@ what behavior they should expect from different parts of the app. If the distinction between third-party and first-party content is too small, the application should also follow the [=user agent duties=] for its first-party content. +For example, if the application doesn't show a distinct address bar +when browsing third-party content, +that likely means that +its first-party pieces should also follow the [=user agent duties=]. Similarly a library that implements the web platform may or may not be a full [=user agent=].