Progressive Web Apps (PWA): nuisance

[apelly]

Prerequisites

• I verified that this is not a filter list issue. Report any issues with filter lists or broken website functionality in the uAssets issue tracker.
• This is NOT a YouTube, Facebook or Twitch report. These sites MUST be reported by clicking their respective links.
• This is not a support issue or a question. For support, questions, or help, visit /r/uBlockOrigin.
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
• The issue is not present after disabling uBO in the browser.
• I checked the documentation to understand that the issue I am reporting is not normal behavior.

I tried to reproduce the issue when...

• uBO is the only extension.
• uBO uses default lists and settings.
• using a new, unmodified browser profile.

Description

To stop progressive web app installation I want to block and similar. This appears to be impossible.

A specific URL where the issue occurs.

https://www.publico.pt/

Steps to Reproduce

Setup rule.
Refresh website.
It is still offered as a PWA

Expected behavior

Website is treated as a website

Actual behavior

Website borks the browser into looking like another app

uBO version

1.61.2

Browser name and version

Firefox Beta Android: 134.0b1 (Build #2016058295), hg-35267f2f61e6+ GV: 134.0-20241125200000 AS: 134.0

Operating System and version

android 15

[uBlock-user]

It is still offered as a PWA

Firefox doesn't support PWAs

[apelly]

Firefox doesn't support PWAs

The version of firefox for android I am using most certainly does.

Here's a random article from 2017: https://hacks.mozilla.org/2017/10/progressive-web-apps-firefox-android/

[uBlock-user]

Add publico.pt##^link[rel="manifest"][href^="/manifest.json"]

[gwarser]

Generic filter should still work:

*$csp=manifest-src 'none'

[apelly]

Generic filter should still work:

*$csp=manifest-src 'none'

That is a neat trick! Every time I take a long look at uBO I learn something cool.

I can not make it work though. And I'm not savvy enough to track down where it fails. I've tried on chrome & firefox desktop and I can't see any injected content security policy in the network traffic, or the html header. Chrome still offers to install it as an app. It doesn't work on firefox for android either, but I didn't look into debugging that.

For anyone following along at home, I found these two links useful:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/manifest-src
https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#csp

[uBlock-user]

@apelly Did you try #26266 (comment) on Firefox Android ?

[apelly]

Add publico.pt##^link[rel="manifest"][href^="/manifest.json"]

I appreciate the help. I tried this and it did not solve my issue on firefox for android.

[uBlock-user]

tested -

||publico.pt/manifest.json^ and *$csp=manifest-src 'none' both worked on Brave, so they should work on FA too.

[gwarser]

You need to clear browser cache for it to work. See: https://old.reddit.com/r/uBlockOrigin/comments/ran1sf/how_can_i_block_manifest_files_on_my_mobile/

[apelly]

You need to clear browser cache for it to work. See: https://old.reddit.com/r/uBlockOrigin/comments/ran1sf/how_can_i_block_manifest_files_on_my_mobile/

Useful information! I've been googling on and off in my spare time for over a year to solve this, and somehow never surfaced your link.

As I was testing things this morning I noticed the cache issue, and a reload quirk. Here is what I wrote before I read your reply:

I just tested *$csp=manifest-src 'none' with Brave. It worked.

Then I tested it with Chrome and it didn't work. So I removed the site from my history, deleted cookies, reloaded, and it did.

But a couple of minutes later with both Brave and Chrome, when the site refreshes itself it looks like the rule is ignored and manifest.json shows up again.

A couple of things to note here:

1. At first I thought that a minute is all it takes to go to a website and stick a link on your launcher, so problem solved. But that's not the case. I only want to shortcut to a site that I've already used a bunch, so there will be browsing history, which appears to trump a fresh CSP.
2. I don't know what the specific issue is, but I can't replicate the above limited success on android. I've tried deleting the history, but with Firefox for android this is as clunky as an elephant dancing with a camel. I've also tried incognito with no luck.

I also tested ||publico.pt/manifest.json^ with brave and chrome and it works better. It survives when the website refreshes.

I also tested ||*/manifest.json^. It also works on the desktop and it's closer to the generic rule I'm looking for.

I still can't get anything to work with Firefox on android.

[apelly]

OK. Thank you for all your help.

For now, this works consistently for me to on Firefox for Android:

1. Use the filter *$csp=manifest-src 'none'
2. Open the site you want to bookmark in a private tab.
3. "Add to home screen" as usual.

I've been chasing this for so long now, I'm happy with this 99% solution. I can't be arsed following up with Firefox about why Android cached data is so difficult to manage, or why cached data should be used against csp advice.

And thanks for your insights @gwarser

With any luck your info here will get indexed better than reddit.