Many useful WebXDC apps (especially music, media, weather, news, etc.) would benefit from the ability to load resources from specific trusted domains while maintaining WebXDC’s strong security guarantees. My Idea: Add an optional allowed-domains in manifest.toml: … allowed-domains = ["api.spot…

A workaround that works pretty well, which you can do today already: Use a bot to get internet access. Your webxdc mini app can use the status update API or the real-time API for sending requests that the bot then answers. The bot is a normal program, it can give you internet access or access to w…

I’d like to hear legit use cases for this. Because I think most of the time if one needs access to some website then what you’re after is not a WebXDC app but a regular website or a browser extension. Regarding the technical part of this proposal: this would require an amount of non-trivial code, b…

Providing a new fetch API that could proxy each request after sanitation & filtering would be a cheap workaround.

One should be weary that this would bypass the usual security stuff that browsers have around HTTP requests, namely Access-Control-Allow-Origin, cookie-related stuff, maybe more.

[image] WofWca: legit use cases I just remembered one myself, thanks to @ian ’s comment: the “maps” feature in Delta Chat is precisely this: a WebXDC app that uses this special “fetch” API provided by Core to fetch map tiles: packages/target-electron/src/deltachat/webxdc.ts 4341d4…

One drawback for suggesting as a workaround to visit the original website is if it would incur a huge cost, such as if the webpage and its assets took a lot of time and network bandwidth to load up and could track & fingerprint the user quite a bit. In contrast, it would take orders of magnitudes l…

[image] ian: Another possible advantage compared to visiting the webpage would be if automation was involved, such as a (system-) webxdc that kept checking the given API endpoint (or HTML) for changes according to a schedule so the user would not have to and notified the user of events immediate…

A scheduled send later feature could still serve 99% of its utility if it could only send out the message while one of my clients are online. Sometimes it’s as simple as “don’t reveal how long I have been up yesterday” or “don’t wake up the recipient if you know they forgot to mute their phone while…

[image] Simon: Even if you skip technical implementation complexity, there is still the question on who would audit or review those rule - users can not judge if a cryptic regexp filter rule is safe or not (even I could not). I wasn’t suggesting complex regex rules at all. I proposed a simple…

Optional Limited Internet Access for WebXDC Apps (Domain Whitelist)

Feature Proposal

ian July 19, 2026, 4:21pm 2

I think in certain cases, it would also be useful if each user could also specify additional origins to allow either per instance, or per app (correlated by file hash). Think of an RSS feed reader xdc that could aggregate entries from the list of websites each user wants to follow.