XAML Browser Applications

{{Infobox file format

| name = XBAP

| icon =

| extension = {{mono|.xbap}}

| mime = application/x-ms-xbap

| type code =

| uniform type =

| owner =

| genre = Package management system, file archive

| container for = Software package

| contained by =

| extended from = ZIP

| extended to =

| standard =

}}

XAML Browser Applications (XBAP, pronounced "ex-bap") are Windows Presentation Foundation (.xbap) applications that were intended to run inside a web browser such as Firefox or Internet Explorer through the NPAPI interface. Due to NPAPI being phased out in recent years, and from lack of support, there are currently no browsers that support XBAP applications.{{Cite web |last=adegeo |title=FAQ about XBAP supportability |url=https://learn.microsoft.com/en-us/dotnet/desktop/wpf/app-development/xbap-faq?view=netframeworkdesktop-4.8 |access-date=2024-05-15 |website=learn.microsoft.com |language=en-us}}

Hosted applications run in a partial trust sandbox environment and are not given full access to the computer's resources like opening a new network connection or saving a file to the computer disk and not all WPF functionality is available. The hosted environment is intended to protect the computer from malicious applications; however it can also run in full trust mode by the client changing the permission. Starting an XBAP from an HTML page was seamless (with no security or installation prompt). Although one perceived the application running in the browser, it actually ran in an out-of-process executable (PresentationHost.exe) managed by a virtual machine.

XBAP limitations

XBAP applications have certain restrictions on what .NET features they can use. Since they run in partial trust, they are restricted to the same set of permission granted to any InternetZone application. Nearly all standard WPF functionality, however, around 99%, is available to an XBAP application. Therefore, most of the WPF UI features are available.

{{cite web

| url = https://msdn.microsoft.com/en-us/library/aa970910.aspx

| title = WPF Partial Trust Security

| publisher = MSDN

| access-date = 2011-02-16

| quote = For XBAP applications, code that exceeds the default permission set will have different behavior depending on the security zone. In some cases, the user will receive a warning when they attempt to install it. The user can choose to continue or cancel the installation. The following table describes the behavior of the application for each security zone and what you have to do for the application to receive full trust.

}}

Starting in February 2009, XBAP applications no longer function when run from the Internet.{{cite web|url=https://blogs.msdn.microsoft.com/ieinternals/2011/02/11/ie9-rc-minor-changes-list/|title=IE9 RC Minor Changes List|date=11 February 2011 }} Attempting to run the XBAP will cause the browser to present a generic error message.{{cite web|url=https://blogs.msdn.microsoft.com/ieinternals/2011/03/09/ie9-xbaps-disabled-in-the-internet-zone/|title=IE9 – XBAPs Disabled in the Internet Zone|date=9 March 2011 }} An option exists in Internet Explorer 9 that can be used to allow the applications to run,{{cite web|url=https://stackoverflow.com/a/6474872 |title=XBAP - This application type has been disabled|website=Stack Overflow}} but this must be done with care as it increases the potential attack surface - and there have been security vulnerabilities in XBAP.{{cite web|url=https://technet.microsoft.com/library/security/ms13-004?f=255&MSPPError=-2147217396|title=Microsoft Security Bulletin MS13-004 - Important|last=BetaFred|website=technet.microsoft.com|date=March 2023 }}

=Permitted=

2D drawing
3D
Animation
Audio

=Not permitted=

Access to OS drag-and-drop
Bitmap effects (these are deprecated in .NET 3.5 SP1)
Direct database communication (unless the application is fully trusted)
Interoperability with Windows controls or ActiveX controls
Most standard dialogs
Shader effects
Stand-alone Windows

References

External links

[https://msdn.microsoft.com/en-us/library/aa480229.aspx Windows Presentation Foundation Security Sandbox]

Category:.NET Framework terminology

Category:Microsoft application programming interfaces