We should add some documentation describing what steps can be taken to ensure that deployed Blazor Hybrid apps run with webview versions that meet the security/API requirements of the app. Following is a draft of what such a page might look like:
Keeping webviews up-to-date in deployed Blazor Hybrid apps
By default, the BlazorWebView control uses the currently-installed platform-specific native webview. Since webviews are periodically updated with support for new APIs and fixes for security issues, it may be necessary to ensure that your app is using a webview version that meets your app's requirements. This could be achieved in the following ways:
- Checking the webview version being used on the current platform and prompting the user to take any necessary steps to update (applicable for all platforms).
- Packaging a fixed-version webview within your app, using it in place of the system's shared webview (applicable only for Windows).
Platforms
Different platforms have various mechanisms for keeping the installed webview up-to-date and checking the current webview's version.
Windows (.NET MAUI, WPF, WinForms)
On Windows, the Chromium-based Edge WebView2 is required to run Blazor web apps. By default, the newest installed version of WebView2 (known as the Evergreen distribution) is used. If you wish to ship a specific version of WebView2 with your app, you can use the Fixed Version distribution mode.
See the WebView2 distribution docs for more information about selecting a WebView2 distribution mode and checking the currently-installed WebView2 version.
Android
The Android webview is distributed and updated via the Google Play Store. The webview version can be checked by reading the user agent string. The webview's navigator.userAgent property can be read using JavaScript interop and optionally cached using a singleton service if the user agent string needs to be made available outside of a Razor component context.
iOS/Mac Catalyst
iOS and Mac Catalyst both use WKWebView, a Safari-based control, which is updated by the operating system. Similar to the Android case, the webview version can be determined by reading the webview's user agent string.
Open questions:
- It doesn't seem we have a more straightforward way to check the webview versions on iOS, Mac Catalyst, and Android than reading the user agent string via JavaScript interop. Am I wrong about this? Should we consider supporting a more streamlined way of doing this?
- If the method I've described for checking the webview version is something we want to recommend, would it be worth providing a more concrete code sample?
- Does anyone know if old versions of iOS can receive new WKWebView updates? If the WKWebView version is strictly tied to iOS updates, we might want to suggest checking the iOS version rather than the user agent string.
- Are there any other details I'm missing?
@Eilon
We should add some documentation describing what steps can be taken to ensure that deployed Blazor Hybrid apps run with webview versions that meet the security/API requirements of the app. Following is a draft of what such a page might look like:
Keeping webviews up-to-date in deployed Blazor Hybrid apps
By default, the
BlazorWebViewcontrol uses the currently-installed platform-specific native webview. Since webviews are periodically updated with support for new APIs and fixes for security issues, it may be necessary to ensure that your app is using a webview version that meets your app's requirements. This could be achieved in the following ways:Platforms
Different platforms have various mechanisms for keeping the installed webview up-to-date and checking the current webview's version.
Windows (.NET MAUI, WPF, WinForms)
On Windows, the Chromium-based Edge WebView2 is required to run Blazor web apps. By default, the newest installed version of WebView2 (known as the Evergreen distribution) is used. If you wish to ship a specific version of WebView2 with your app, you can use the Fixed Version distribution mode.
See the WebView2 distribution docs for more information about selecting a WebView2 distribution mode and checking the currently-installed WebView2 version.
Android
The Android webview is distributed and updated via the Google Play Store. The webview version can be checked by reading the user agent string. The webview's
navigator.userAgentproperty can be read using JavaScript interop and optionally cached using a singleton service if the user agent string needs to be made available outside of a Razor component context.iOS/Mac Catalyst
iOS and Mac Catalyst both use WKWebView, a Safari-based control, which is updated by the operating system. Similar to the Android case, the webview version can be determined by reading the webview's user agent string.
Open questions:
@Eilon