New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 902216 link

Starred by 2 users

Issue metadata

Status: Available
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: 2
Type: Bug



Sign in to add a comment

uninstalled mobile PWA apps can still create notifications

Project Member Reported by mukai@chromium.org, Nov 6

Issue description

Chrome Version: 72.0.3596.0 ?
OS: Android 9; Pixel 3

What steps will reproduce the problem?
(1) go to instagram.com
(2) sign in to the website
(3) 'Add to Homescreen'
(4) make sure it works
(5) 'Uninstall' the instagram app (drag the app icon to 'Uninstall')
(6) wait for a while for some events on the site

What is the expected result?
- no notifications since the app is uninstalled

What happens instead?
- still get notifications


I can fix this by unregistering the service worker from chrome://serviceworker-internals.

Please use labels and text to provide additional information.

If this is a regression (i.e., worked before), please consider using the
bisect tool (https://www.chromium.org/developers/bisect-builds-py) to help
us identify the root cause and more rapidly triage the issue.

For graphics-related bugs, please copy/paste the contents of the about:gpu
page at the end of this report.


 
Cc: peter@chromium.org
Owner: yfried...@chromium.org
+Yaron, Peter

Is it something you can triage? Not sure if it's intended, imagining the situation this'd feel bad.
Cc: peconn@chromium.org pjmclachlan@google.com pcovell@chromium.org
+Peter, Peter, Paul

Jun, did you grant notification permission to Instagram prior to installing it? We don't grant permission when a WebAPK is being installed (AFAIK), and while we've discussed the idea of revoking the permission when it's being uninstalled, I don't think that's been implemented yet.

There is a second step to this problem too: notifications will stop showing up when the WebAPK's permission gets revoked in Android UI, but will return when the WebAPK subsequently gets uninstalled because Chrome's permission will then take precedence again.

We definitely don't have a comprehensive story from a user experience point of view here. We share storage with Chrome, which means that you'll continue to be logged in to Instagram as well after uninstalling the app. I feel like it would make sense for permissions such as audio & video access to persist as well, so maybe notifications are the exception here as they can trigger without visiting the site?

In general I'd love to see us integrate permissions with Android UI more closely for installed PWAs, as that's what users expect. The concrete question here is how that relates to Chrome's internal permission state, and what happens to that when the PWA gets uninstalled.
I actually don't remember exactly but I should have granted the permission if asked.

Here's the background why I did this;
1. I got a new phone. During the setup, I decided to go with PWA version for Instagram
2. It was great -- I used it for days
3. then I changed my mind due to some feature parity of Instagram; I "switched" to the app, meaning installed its native app and removing the PWA version

And yes, I lacked the care to log out from Instagram before removing it, so I should have been still logged in to Instagram in Chrome after I removed the PWA icon.
Cc: dominickn@google.com pkotw...@chromium.org
Per the related email thread, it does seem reasonable to revert back to "ASK" if we get a notification, detect that a WebApk was previously installed but not currently installed. I imagine we'd use the presence of the webapks shared pref file to verify this. There's an edge case where if we're doing our periodic  storage cleanup of webapps but we haven't yet reconciled the notification bit, we'd miss recognizing it. We could consider adding a check there too (WebappRegistry.unregisterOldWebapps)

peter@ - wdyt?
I'm fine with that, but I would prefer for us to agree on (or work towards) a more holistic approach rather than solving these issues as they come up. Would doing so make sense for desktop PWAs as well?
Cc: mgiuca@chromium.org
+mgiuca

That's a fair request
Cc: -dominickn@google.com dominickn@chromium.org
Components: UI>Browser>WebAppInstalls UI>Notifications
Should this be done for all other permissions too? Consistency across desktop and mobile seems desirable, but I agree with peter@ that a more holistic approach makes sense. I'm currently shopping around a plan where we start tying persistence of capability access + background work to installation, which may have some bearing here.
Could we limit the "revert to ASK" behavior only to the case where the user opted in to push notification from the WebAPK?  I can imagine a user being surprised if they opted in to push on the website, later install the webAPK, remove the APK, and stop getting notifications.  
#8: we could do this with some extra metadata, but I wonder whether that case is a significant enough problem to justify the extra work/caching?

More concretely, even if you did opt into push on the website, isn't uninstalling the WebAPK a relatively strong signal that you don't want to hear from it any more - via Chrome or the APK? I think the fact that Android apps get notifications permission by default also weighs in here.
#9 I feel like this is similar to the issue of whether we want to delete data for an origin when uninstalling an app: we have a dilemma because it would be valid to disable notifications in this use case:

1: Install app.
2: Enable notifications.
3: Uninstall app.

(Should disable notifications.)

But invalid to do so in this case:

1: Use site.
2: Enable notifications.
3: Install site.
4: Decide you prefer the non-installed (browser tab) UI.
5: Uninstall app.

(Should not take the uninstall as a signal that you don't wish to use the site any more.)

I think we should err on the side of not overreaching. Going back to Ask would be fine though.

Sign in to add a comment