TAG finding on user agents

[RupertBenWiser]

Hey all 👋

The W3C is doing a finding into user agents. It turns out there hasn't been a definitive resource on this up to this point!

https://w3ctag.github.io/user-agents/

I thought it would be cool for the WebView CG to comment on this to make sure we feel that WebViews are fairly represented in the finding.

[RupertBenWiser]

I thought it would be helpful to prepare a response that we can iterate over as a group:

Speaking as someone involved in the embedded web, I think it would be helpful to be clear where in a tech stack one becomes a user agent. For example, while it might be tempting to call a WebView a user agent, WebViews are often highly configurable libraries and it is not appropriate for them to override the decisions of the application developer. I think defining the user agent as the final compiled application that owns web browsing would be a helpful clarification; issue 7 already seems to assume this.

The scoping matters because it means that when we are discussing these duties, we are generally talking about extremely large app ecosystems (in the order of millions) that embed WebViews. The ecosystems section for instance feels very much to me like it is focused on browsers where they are a lot more generic in their offerings; social apps may be more “sticky” for users to switch away from. The honesty section could also be an example of where an app may be different; app developers may opt to provide a frictionless experience by autogranting permissions instead of prompting users on trusted websites.

This distinction may also help clear up why an app developer may be interested in using a component such as SFSafariViewController to embed web content as in that case, their application wouldn’t be the user agent.

[NiklasMerz]

I can agree with the response you posted. WebViews should definitely considered and defining them as user agents is tricky.

Some additional first thoughts:

1. Developers implementing WebViews also need to trust the WebView providers because they have limited choices and pass that down to the user.
2. Same for browsers: some ecosystems make it more difficult to switch browsers.
3. Furthermore users of apps with WebViews might not be aware that they are using a user agent.

[dontcallmedom]

+1 on chiming in; in particular, I think it would be useful to get to the key question of when do you become a web user agent.

My hunch is that it should be articulated as a quid pro quo between expected duties and rights: by accepting the duties of a user agent, its provider is (more likely to be) recognized to have the said agent accepted by content providers (e.g. not blocked by webapps firewall, recognized as valid compatibility target, etc).

[AshleyScirra]

• If a WebView is considered a user agent, it may oblige them to support user interface capabilities like download, share, Bluetooth device selection etc. which may not be feasible/appropriate
• If the app containing a WebView is considered a user agent, it may oblige them to support tough security requirements at all times, as if they might do something like access their online banking through the app, even if that is not something the app does

Perhaps there needs to be a separate definition for this case - such as a "Webview agent" or "embedded user agent"? Alternatively perhaps either the app or webview could be nominated to be the user agent, but specify that there are exceptions for this case so there is not an obligation to meet the full requirements of a web browser.