I'm having this pop-up on the macOS WebApp

[Populus]

Hi.

I'm using the MacRumors WebApp on macOS Sequoia, and I'm having this annoying pop-up each time I try to use the search:

In case you don't understand what it says in Spanish, it says "MR Forums (the WebApp) wants to use confidential information stored in "Safari Forms AutoFill Encryption Key" [stored] in your Keychain".

I don't know what it is, and I don'r want to grant it permission, as I can use the MR Forums WebApp without granting access to it. Is there something I can do, or that you can change on the website, to get rid of it? Thank you.

 

[Boyd01]

I get the same thing using the Safari File > add to dock feature on Sequoia.

Apparently, Sequoia thinks any kind of autofill is like a password entry box? However, I don't think it's accurate to call MacRumors a "web app" (although this might be more of a semantic issue). "Real" web apps (technically called Progressive Web Apps") are like websites but also include some special resources to make them installable. I created my own web app about 4 or 5 years ago. Chrome and Edge have supported web apps on the Mac for awhile now but Safari did not.

Then, with Sonoma (IIRC) they introduced a Safari feature that could turn any web page into a "web app" but this is not the same thing as a "real" web app. Still not sure if Safari has support for these "real" web apps which have some special features that ordinary sites don't have; for example, they have persistent data storage where regular sites have their storage automatically purged if you don't visit them for a week.

Anyway, we had a staff discussion about the web app a couple years ago. The Xenforo software has the option to turn the site into a real progressive web app, but at that time, MacRumors was not using that option. Not sure if that changed, but I don't think it has.

One way to check for "real" web apps is to open the page in Chrome. A progressive web app will have the option to install in the address bar. For example, the little download icon shows when I visit my own (real) web app

However, when I go to MacRumors, there is no such icon

tl;dr; I don't think MacRumors has a real web app, this is just a Safari feature. So, IMO, this alert might be Safari just being overly sensitive about autofill as part of enhanced security in Sequoia. Don't see any way to disable this alert in the settings. If you need to use this Safari in this way, I guess you could just choose the "always allow" option in that dialog. Could be wrong, but don't think there's anything MacRumors can do about this.

 

[Populus]

I get the same thing using the Safari File > add to dock feature on Sequoia.

View attachment 2472260


Apparently, Sequoia thinks any kind of autofill is like a password entry box? However, I don't think it's accurate to call MacRumors a "web app" (although this might be more of a semantic issue). "Real" web apps (technically called Progressive Web Apps") are like websites but also include some special resources to make them installable. I created my own web app about 4 or 5 years ago. Chrome and Edge have supported web apps on the Mac for awhile now but Safari did not.

Then, with Sonoma (IIRC) they introduced a Safari feature that could turn any web page into a "web app" but this is not the same thing as a "real" web app. Still not sure if Safari has support for these "real" web apps which have some special features that ordinary sites don't have; for example, they have persistent data storage where regular sites have their storage automatically purged if you don't visit them for a week.

Anyway, we had a staff discussion about the web app a couple years ago. The Xenforo software has the option to turn the site into a real progressive web app, but at that time, MacRumors was not using that option. Not sure if that changed, but I don't think it has.

One way to check for "real" web apps is to open the page in Chrome. A progressive web app will have the option to install in the address bar. For example, the little download icon shows when I visit my own (real) web app

View attachment 2472258

However, when I go to MacRumors, there is no such icon

View attachment 2472259

tl;dr; I don't think MacRumors has a real web app, this is just a Safari feature. So, IMO, this alert might be Safari just being overly sensitive about autofill as part of enhanced security in Sequoia. Don't see any way to disable this alert in the settings. If you need to use this Safari in this way, I guess you could just choose the "always allow" option in that dialog. Could be wrong, but don't think there's anything MacRumors can do about this.

Thanks. Yeah, I called it “Web App” to distinguish it from other forms of saving or bookmarking the website. On iOS, MR Forums is a Progressive WebApp, right? I thought it was enabled for macOS 15 as well.

 

[Boyd01]

I don't think MacRumors is a progressive web app at all, AFAIK there would be no way to make it one on iOS but not MacOS. Did a search and I see we had a user contact from 2022 which is what prompted the staff discussion. Hopefully I'm not revealing anything confidential here, but we learned arn is the person who decides this type of thing. He did not participate in the discussion, but we assumed it was intentional and there didn't seem to be much interest from staff to adopt the xenforo PWA feature.

Again, this was 2022 and it hasn't come up again since. Apple makes it very difficult to determine whether something is a PWA on iOS. At least here in the US, all browsers must use Safari's browser engine and when you install a real PWA on iOS, Safari calls it a "bookmark" (even though it really is a PWA).

 

[NoBoMac]

Wild (probably wrong) guess: "lock after X inactivity" in KeyChain Access is at some low value? I see a metadata entry for MR in Keychain.

 

[BigBlur]

I don't think MacRumors is a progressive web app at all, AFAIK there would be no way to make it one on iOS but not MacOS. Did a search and I see we had a user contact from 2022 which is what prompted the staff discussion. Hopefully I'm not revealing anything confidential here, but we learned arn is the person who decides this type of thing. He did not participate in the discussion, but we assumed it was intentional and there didn't seem to be much interest from staff to adopt the xenforo PWA feature.

Again, this was 2022 and it hasn't come up again since. Apple makes it very difficult to determine whether something is a PWA on iOS. At least here in the US, all browsers must use Safari's browser engine and when you install a real PWA on iOS, Safari calls it a "bookmark" (even though it really is a PWA).

I believe forums.macrumors.com is written/developed to be a PWA, but www.macrumors.com is not.

There are a couple easy ways to see if a Home Screen "bookmark" is a PWA or not on iOS/iPadOS.

• If it's a PWA:
  • There will be no address bar and Safari's other UI controls are not available.
  • It'll appear as its own app in the App Switcher.
• If it's not a PWA:
  • Regular Safari is used, meaning the address bar and Safari UI controls are shown.
  • Shows as Safari in the App Switcher.

Also, when forums.macrumors.com is installed as a PWA on iOS/iPadOS, it then supports push notifications, which is neat.

 

[Boyd01]

If it's a PWA:

• There will be no address bar and Safari's other UI controls are not available.

Are you sure about that? It's been a few years since I looked at all the docs, but I just did a quick check and think this is controlled by a parameter in the PWA manifest which can be set however the developer chooses:

"The display mode determines how much of the browser UI is shown to the user when the app is launched within the context of an operating system. You can choose to show the full browser interface or hide it"

https://developer.mozilla.org/en-US/docs/Web/Manifest/display

But you might be onto something regarding the difference between the forums and front page. When I go to the forums subdomain in Chrome, it has a different kind of icon in the address bar from my own PWA and asks to choose an "app". I don't quite understand the difference, but someone else can probably explain that.

[edit] The more I think about it, the different icon might be due to the fact that forums.macrumors.com is a subdomain. I believe subdomains can have their own web apps, so the "open with" prompt might be there to choose between the subdomain (forum) app or the main app (which, apparently, doesn't exist).

 

[BigBlur]

Are you sure about that? It's been a few years since I looked at all the docs, but I just did a quick check and think this is controlled by a parameter in the PWA manifest which can be set however the developer chooses:

"The display mode determines how much of the browser UI is shown to the user when the app is launched within the context of an operating system. You can choose to show the full browser interface or hide it"

https://developer.mozilla.org/en-US/docs/Web/Manifest/display

Ah, didn't realize the developer had the option to specify how PWAs appear. Learned something new! At least in my experience, all the PWAs I've used have hidden the browser controls and behaves the way I described above.

I wonder what the reason would be to create a PWA that still shows browser controls? I would think they would always want them hidden so that it functions more like an actual app.