Web App Separate Isolated Session

[andrewvinci]

The ability to simply convert a website to an app (whatsapp, music players, etc.) is next to essential for me, and how simple it is in Edge is amazing.

Edge Dev however seems to treat this as simply a new borderless window and share the current session data (mostly, what accounts are logged in), however it would be a lot more useful if it was a completely isolated session (cookies, cache, etc.). 

Example of why this is critical is I have multiple Microsoft accounts, work O365, contract with a separate "guest teams" account, and my personal MS account. Currently these get cross-contaminated in terms of what which one is signed in to my "Teams Web App" and it is beyond frustrating; once I was careless and posted a file to the wrong person - thankfully harmless.

Currently on Dev.

[#2]

Hello Andrew, this is such a great idea!

It'd help me too, prevent other websites from snooping in my social media stuff because I have Facebook, Twitter and Instagram installed as PWA but the fact that they are currently not isolated makes them less secure, privacy-wise.

[#3]

@andrewvinci 

---

@andrewvinci wrote:

I have multiple Microsoft accounts, work O365, contract with a separate "guest teams" account, and my personal MS account. Currently these get cross-contaminated in terms of what which one is signed in ...

---

Does this cross-contamination also happen if each account (Microsoft Account, work or school account) has its own browser profile? As far as I can tell, browser data stay within the profile in use at the time, as do installed apps.

[#4]

@Noel Burgess 

I haven't tested I must admit, however I would hope not otherwise it would be a more substantial issue! I keep all of my various login sessions under my personal MS account. One big reason is my O365 work account doesn't support data sync (we aren't paying for the higher tier AAD). Even so, I am not sure how to determine which profile the Web App is running under.

[#5]

@andrewvinci thanks for bringing this up. We are discussing this and running some experiments. Currently, PWAs are installed per profile, so if you have two profiles in Edge, you can have two PWAs installed (one for each profile) - those are completely separate. You are correct about the current design with one profile, though. PWAs behave the same with regard to cookies (etc) as if you were just on the website in the browser. You can imagine how much of a benefit this is for web developers who can trust that when you create a PWA from their site, you remain logged in. 

But as I say, we think this is probably something that some end users want, and some web devs want. So we are planning on being very data driven. We may run A/B experiments, but first we will want to get developer reaction and try to figure out a good design that will make the majority of people happy.

-John

[#6]

@HotCakeX 

Amazing how we just keep dancing around the issue of Edge not having "Containers" isn't it? Still the one and only reason that I don't delete Firefox. If the Web Apps were each established as a stand-along sandbox, that would be a decent compromise on the idea.

[#7]

@johnjansen Thanks John, fully aware of the advantage of that. I tried to keep my initial post fairly concise. I'll stick to "web app" here as this is mostly about apps that people install from a website. e.g. they go to www.contoso.com, and then hit the '...' and 'Apps' -> "Install", regardless if the site is a standard webpage, or a proper PWA (with manifest, etc.).

In the case where an app is installed from having already visited the website, I could foresee keeping 'signed-in ness' and a consistent experience for devs, that same-site cookies could be kept, and all others discarded (this may still break SSO); with an option to start a fresh session for privacy focused users.

Personally, even if the user is required to sign-in again, I wouldn't expect that it would cause excessive friction/bounce rate. Even a notification "For your privacy, we keep this new App separate to your other browsing - so you'll have to sign in again".

As you indicated, A/B is the way to go. 

[#8]

They can't limit it only to that. Edge gives us freedom to install ANY website as an app, not only websites that are kinda a web app, such as Whatsapp web, Spotify web player, Google photos, Outlook etc.