[Feature Request] WebView2 embedded browser

[jmprieur]

Is your feature request related to a problem? Please describe.

On the desktop, an embedded browser only exists on .net45 and it is using an old version of Internet Explorer.

We need an embedded browser that:

• also work on .Net Core on Windows
• uses Edge as the actual engine (Edge is needed to satisfy the Fido scenario)

This browser is WebView2.

Stream of work:

• Refactor current WebBrowser implementation to extract out marshalling to UI thread and maybe hosting in a panel

• Add a WebView2 implementation of embedded browser on .NET Fx and .NET 5 https://docs.microsoft.com/en-us/microsoft-edge/webview2/gettingstarted/win32. Currently thinking it should go in the box with .NET Fx.

• Change the WebUiFactory to prefer WebView2 if it is installed

• Docs and log messages to tell ppl how to install WebView2

• (Stretch goal) Add an WithEmbeddedWebViewOptions to MSAL that exposes an enum stating "PreferredBrowser" with values - Auto (default) - which means automatic fallback to WebBrowser, WebView2, LegacyWebBrowser.

• (Stretch goal) Change MSAL.Desktop to add support for WebView2 on .net core 3.1. We should have 1 method that pull in all the MSAL.Desktop functionality, smth like .WithDesktopFeatures()

• Goal for MSAL 5 - review the default browser selection. For example for B2C we should no longer allow LegacyWebBrowser as it is unusable.

@henrik-me @jmprieur to review the stretch goals.

Technical aspects:

You can use GetAvailableCoreWebView2BrowserVersionString/CoreWebView2Environment.GetAvailableBrowserVersionString to detect if a compatible version of the browser or runtime is installed.]
How can we disable:
o The context menu
CoreWebView2Settings.AreDefaultContextMenusEnabled]
o The developer tools (F12)
CoreWebView2Settings.AreDevToolsEnabled]
o The go back / go forward keys
I don’t think we have a way to do this one.]

Is there an equivalent to WebBrowser.DocumentTitleChanged and WebBrowser.Title ?
[davris: Yes DocumentTitle and DocumentTitleChanged]

[jmprieur]

See also;

• AcquireTokenInteractive for AD B2C on .NET Core 3.0 WPF desktop client does not work #1213
• https://docs.microsoft.com/en-us/dotnet/api/system.windows.forms.application.sethighdpimode?view=netcore-3.0#System_Windows_Forms_Application_SetHighDpiMode_System_Windows_Forms_HighDpiMode_

[bgavrilMS]

1. I agree with adding a new platform, but we should be wary of adding a new SKU (x-ms-client-sku). While this will give us better telemetry, AAD has so many feature flags that are tied to the SKU string that it will be a bug farm to find them all.

2. We might have to use a WPF panel instead of a WinForms panel if we want high DPI support.

[jmprieur]

@bgavrilMS :
For 1, which SKU would we reuse? (Desktop, I'm assuming) ?
For 2, I believe that .NET Core 3.0 supports HDPI (see the link above)

[bgavrilMS]

For 1, I would reuse the .net core SKU, which is MSAL.NetCore

[bgavrilMS]

Probably blocked by novotnyllc/MSBuildSdkExtras#191
Work can still happen, but we won't be able to pack.

[trickpatty]

I see that this work is blocked for the time being. Is there a workaround that you might suggest in order to use this package in a .NET Core 3.0 project?

[jmprieur]

@trickpatty : You can actually use MSAL.NET in a .NET Core 3.0 project already. We have several samples which were updated and work perfectly fine:

• ASP.NET Core Web API tutorial
• .|NET Core daemon app tutorial](https://github.com/Azure-Samples/active-directory-dotnetcore-daemon-v2)
  and we are upgrading the |ASP.NET Core Web app tutorial](https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2) at the moment

This work item is about supporting the embedded browser control on Windows on providing an extra target to benefit from crypto operations which are more reliable on all OS where .NET Core 3 is supported (today there can be a difference of behavior depending on the .NET framework version. See Also #1453

[bgavrilMS]

I renamed the feature request to make it more clear. @jmprieur "better crypto" is not well defined, is there a specific benefit that you have in mind?

[jmprieur]

Thanks @bgavrilMS : I've updated my comment.

[henrik-me]

Important info regarding the timeline:
We are currently prioritizing work that will enable us to ship a netcore 3 target without a dependency on WinForms of WPF for our confidential client (web app/service scenarios).

[henrik-me]

@jmprieur : Thinking this feature should be solely about supporting Edge? Perhaps a separate feature to potentially support a specific netcore3/3.1 target/netstandard?

Asides:
For WebView2 (Edge Chromium): https://docs.microsoft.com/en-us/microsoft-edge/hosting/webview2
For WebView (Wrapping UWP controls in WinForms and WPF): https://docs.microsoft.com/en-us/windows/communitytoolkit/controls/wpf-winforms/webview

[bgavrilMS]

WebView2 has GA-ed. Let's try to use it in 4.24

[Xanen]

I see that 4.24 has released but it appears this didn't make the cut. Using Google as an IDP via an embedded browser on desktop has been broken for quite some time now. I believe the issue was originally reported here: #1561. It's been causing a lot of problems for users of my app that have had to create new accounts because their Google login stopped working. Any updates? Will this be addressed in 4.25? Is there anything that can be done in the meantime apart from using the System browser? That's not really a user-experience I'd feel comfortable pushing out. Thanks!

[jmprieur]

@Xanen. for the moment, you'd need to use the system browser.
We are prioritizing implementing the embedded browser, though. @bgavrilMS will elaborate on when this would be available;

[henrik-me]

@jmprieur @bgavrilMS : If google disallows embedded browsers this feature is not for the scenario @Xanen mentions? Not sure if WAM will work in that case either? Not sure how the Google IDP issue can be solved outside of using the System Browser as that is what Google wants people to use, also it's what Google does for all their own services (afaik).

[Xanen]

Fwiw, the google drive desktop app does not require opening the system browser (but does provide the option to do so).

[henrik-me]

It's possible they have their own app on an allowlist.

[bgavrilMS]

WAM cannot be used with b2c (i'll follow this up). ETA for WebView2 is this quarter.

[jmprieur]

• factory to choose the old and new control
• implementation in .NET classic
• implementation on .NET 5