With the second beta of iOS 17.4, Apple disabled much of the functionality of Progressive Web Apps (PWAs) in the European Union. There was some speculation that it could be a temporary change or a bug related to some of the updates to the app ecosystem in Europe, but Apple has confirmed that PWAs were intentionally removed and won't be returning.
In an update on the Developer website (via 9to5Mac), Apple explains that users in the EU will not have access to Home Screen web apps due to the support for alternative browser engines and the accompanying security risks and work required to implement a new solution.
According to Apple, Home Screen web apps are built on WebKit and its security architecture, and are designed to "align with the privacy and security model for native apps on iOS." Storage isolation and system prompts to access privacy functions on a per-site basis are crucial.
Without isolation, Apple claims that malicious web apps could read data from other web apps and gain access to a user's camera, microphone, and location without user consent. To fix these security issues, Apple would need to build a new integration architecture, which it says is not practical because of the other Digital Markets Act requirements and because Home Screen web apps aren't used by many people.
The iOS system has traditionally provided support for Home Screen web apps by building directly on WebKit and its security architecture. That integration means Home Screen web apps are managed to align with the security and privacy model for native apps on iOS, including isolation of storage and enforcement of system prompts to access privacy impacting capabilities on a per-site basis.
Without this type of isolation and enforcement, malicious web apps could read data from other web apps and recapture their permissions to gain access to a user's camera, microphone or location without a user's consent. Browsers also could install web apps on the system without a user's awareness and consent. Addressing the complex security and privacy concerns associated with web apps using alternative browser engines would require building an entirely new integration architecture that does not currently exist in iOS and was not practical to undertake given the other demands of the DMA and the very low user adoption of Home Screen web apps. And so, to comply with the DMA's requirements, we had to remove the Home Screen web apps feature in the EU.
iPhone users in the European Union can access websites directly from the Home Screen through a bookmark, but PWA features won't be available. Web apps on the Home Screen will be forced to open in Safari (or another default browser) rather than in a dedicated window, there isn't support for long-term local storage, and notifications won't work.
Apple says that the changes are a direct result of DMA compliance, and will affect only a "small number of users." The company also says that it regrets the impact the change will have on developers of Home Screen web apps and iPhone users.
The update to Home Screen web apps comes alongside many other changes to the App Store in the European Union, with Apple allowing alternative app marketplaces, alternative payment methods, different browser engines, and more.
