12

I am working on web application that needs data it can only get from its locally installed native application browser.

How can you get around the browser sandbox so that you can communicate (securely, since the data is potentially sensitive), with a native application.

In the only example that I found, the user manually move some tokens and files between the two, which is a horrible user experience that i would like to avoid.

|improve this question
  • 1
    You might be able to get some kind of solution working where the native application contains a small web server that runs on localhost. – amon Feb 3 '15 at 22:12
  • I was thinking that too... I had vague unsolidified concerns that that wouldn't be "concerned". Are there any examples of applications doing this today? (write this up in an answer and you'll probably get the points) – Zak Kus Feb 3 '15 at 22:15
  • An embedded browser would be the best. Embed the browser in the app and program your interactions as needed. – GregJava Feb 16 '15 at 13:47
7

You could embed a webserver in the native application, then your client can make calls to it via hard-coded links to http://localhost/xyz (you may have to worry about cross site scripting warnings here, and/or run the server on a non-http port). If you use websockets, your native application can even push data to the web browser once the browser has initiated communication.

I do it myself locally, an embedded webbrowser control requests visualisation data from a custom webserver and when developing I run both on the same PC.

There are many tiny and efficient embedded webservers for C/C++ (Mongoose, NxWeb, civetweb etc), C# tend to go for a full-on WCF server, python comes with a little webserver in it IIRC.

|improve this answer
  • I'm working on a solution like this, but there are some issues when the browser tries to connect via websocket from a webpage from an Internet domain (www.mydomain.com) with a localhost websocket server, specially if the webpage is served with HTTPS it requires the websocket server to be configured to use wss (WebSocket with SSL). If you use a self-signed certificate to "secure" the websocket server then the browser will not like your websocket connection. Firefox will allow it once you accept the insecure local certificate, but other browsers won't let you connect so easy. – David Sep 16 '15 at 15:31
  • 1
    For c# these days the best embedded webserver is probably self hosted owin. – Esben Skov Pedersen Oct 25 '15 at 6:25
8

There's a couple ways you can mingle a native app and a browser app.

You can embed the browser inside the native app, much like PhoneGap apps do on mobile. That will allow you to extend the browser's javascript engine, and let you make calls between the two.

Alternatively, rethink your architecture. Have both the native application and the browser based application use the server as a go-between. So both the browser and native application only talk to the web server, which forwards information between the two as necessary.

Or if you need native functionality... just make a single native application.

I do not recommend the 'local web server' approach for anything other than applications run in controlled environments. If your software is intended to install and run on end user machines with minimal support requirements, you'll find yourself dealing with a whole host of firewall and anti-virus software related problems.

|improve this answer
  • The data I need from the native app is on whether that machine (rather than user) is acceptable. If you use a normal web server as a go between, can you be sure the machine the browser is on is the same one the native app evaluated. Also, totally agree, shoudln't have two for no good reason, but we have our reasons ^_^ – Zak Kus Feb 4 '15 at 0:19
  • Also, its not clear to me how embedding a browser in the native app would actually allow communication between the browser and the native app – Zak Kus Feb 4 '15 at 0:21
  • @Zak as I said, you can extend the javascript engine to allow them to talk to each other the way PhoneGap does on mobile apps. You'd define methods that could be called by the javascript on the page which are executed by the native app, or call javascript functs from the native app. – GrandmasterB Feb 4 '15 at 4:48
  • Using an embedded browser like that would, I think, be the best way to ensure the browser is running on the machine it needs to be running on. – GrandmasterB Feb 4 '15 at 4:53
  • Technically i would agree that a native app with a web view is the easiest way. However according to this german language article from heise online the android web-viewer for android 4.3 and below has serious security issues that cannot be fixed. – k3b Feb 16 '15 at 15:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.