Apple is Still Sabotaging Offline-First Web Apps

Today it's possible to build web apps that work offline, that store data client side, that one can use without sending any data to the server. A server is still necessary for sync, but sync is optional.

You might think that giving the user the choice whether to trust the web app with his data would be great for privacy, but Apple disagrees:

Web apps are coming to Mac. With macOS Sonoma, you can add a website — any website — to your Dock. Just go to File > Add to Dock, adjust the name and icon if desired, and the web app icon appears in your Dock.

When a user adds a website to their Dock, Safari will copy the website's cookies to the web app. That way, if someone is logged into their account in Safari, they will remain logged in within the web app. This will only work if the authentication state is stored within cookies. Safari does not copy over any other kind of local storage. After a user adds a web app to the Dock, no other website data is shared, which is great for privacy.

There are, broadly speaking, two ways for a web app to store data on the client:

• Cookies, which get sent with every HTTP request.

• IndexedDB and localStorage, which do not.

These map to two kinds of web apps.

• Client-server web app, where everything is stored on the server and only a session cookie is stored on the client.

• Offline-first web app, where everything is stored on the client, and the server is only necessary for sync.

In the name of privacy, Apple copies over cookies but not IndexedDB and localStorage, supporting client-server web apps but not offline first web apps.