Evaluate progressive web app protection by first identifying where your web app actually runs, then protecting the layer you control. A web app can reach a phone in a browser tab, as a home-screen install or inside a native wrapper published to Google Play and the App Store. Otukan protects that native wrapper: its code and signing identity, the bridge between web content and native functions, and its runtime environment, with attestation your backend can check. In a browser tab or home-screen install, the browser owns the runtime, so security comes from web controls and your server. Android and iOS wrappers are scoped separately.
The full evaluation checklist is in the progressive web app protection solution guide.
Architecture
The phrase “progressive web app” covers three different runtimes. Each has a different owner and a different attack surface.
Browser execution
In a browser tab, your HTML and JavaScript run inside a browser you did not build. The browser enforces origin rules, storage limits and permissions. The same is true when the user adds the app to the home screen: it looks like an app, but the browser engine still runs it.
Web content
Your pages, scripts and API calls are the same wherever they run. They can be inspected, copied and replayed from any desktop, which is why the server must never trust web content on its own.
The native wrapper
A wrapper is a small native Android or iOS app that loads your web content in an embedded web view and exposes some native functions to it, such as files, camera or push notifications. It is signed, distributed through stores and installed like any other app. That makes it protectable, and it makes it a target.
| Runtime | Who controls it | What Otukan protects |
|---|---|---|
| Browser tab | The browser | Nothing directly; use web controls and server checks |
| Home-screen install | The browser engine | Nothing directly; use web controls and server checks |
| Native wrapper | Your team | Wrapper code, bridge, runtime and attestation |
Protection limits
Honest scope is what makes the rest trustworthy. Otukan acts on the component it runs inside.
What Otukan influences
Inside the wrapper, Otukan confirms the build is yours, watches the bridge for injected code, detects debuggers and inspectors on release builds, and applies your response per flow. It also provides app attestation, so your backend can treat requests from the genuine wrapper differently from requests made by scripts calling the same endpoints.
Bridge discipline
The bridge is the part most worth reviewing before any tool is applied. Expose only the native functions the web content genuinely needs, bind each one to an approved origin, and treat every call from the page as untrusted input. Otukan then watches that smaller surface at runtime and reacts when code is injected into it. A narrow bridge protected at runtime is far harder to misuse than a wide one.
What stays with the web layer
Otukan does not rewrite your web content or run inside third-party browsers. Cross-site scripting, content injection and session handling in the page are controlled by your web security practice. The two layers meet at your server, which can combine web session data with signals from the wrapper.
Release
A wrapped web app has two release streams. Test both.
Distribution
Check each store’s expectations for wrapped web apps before you protect anything, since both review the native experience the wrapper provides. The wrapper ships through Google Play and the App Store like any native app. Protection fits the wrapper’s existing pipeline, and your team signs the final build. Confirm the protected wrapper passes store review in your normal release cycle.
Origin and network behaviour
Decide which origins the wrapper may load and which native functions each origin may call. Test that the wrapper refuses an unapproved origin and that the bridge stays closed to it. Then move the device between networks and through a captive portal, and confirm the wrapper does not fall back to loading content from somewhere it should not. For deep-link handling in wrappers, see the deep-link guide.
Updates
Web content updates on your schedule; the wrapper updates through the stores. Rehearse each separately: install, update the wrapper, update the web content, sign in and run the most sensitive flow. Log each run with the wrapper version, web content version, device, OS version and reviewer.