Q1. What is the problem that you are trying to solve?
If a user stores credentials in passbolt for an external application, it is not easy to launch the application even if the URI is given. While it works easy for web-URIs (https://*), it does not work with app-URIs (appname://*). Browsers know how to behave in both cases, but Passbolt treats them differently in the UI and therefore they are not linked/clickable. this causes an additional effort (select, copy, new tab, paste, enter) for what should be one click.
Specific behavior currently
On the webpage (main table, URI column), a HTTP(S) URI is displayed as a button:
<div title="https://example.tld/">
<button class="link no-border" type="button">
<span>https://example.tld/</span>
</button>
</div>
Meanwhile, a custom URI is not wrapped as a button:
<div title="myapp://user@tenant">
<span>myapp://user@tenant</span>
</div>
the same distinction happens in the info panel and in the extension popout
Q2 - Who is impacted?
Everyone who uses custom URI is affected, maybe more people would actually use custom URIs if it worked properly in passbolt. As a specific example, everyone who uses Amazon Workspaces is affected, but that is just one group of many.
Q3 - Why is it important and/or urgent?
Simply, it would cause less confusion for the user if a URI is always a link to click.
It is a strategic feature:
While more and more “apps” work in browser as websites, the amount of services that are providing additional apps outside of the browser is also drastically increasing (the passbolt desktop app is a good example here actually). a lot of these apps can be launched from URIs/deep-links (msteams://, webex://, workspaces://, there’s no limit as anyone can register their own). This feature would to some extend allow people to keep using the passbolt browser extension as usual even for external applications.
It is a security feature:
It would also allow passbolt to stay close to the user as it enables them to use it more like a bookmark manager, leading to better habits of having consistent vaults (no duplicates, always accurate URI) and thereby increasing security (don’t get people used to having old/no URIs set and therefore always use search function to insert credentials on potentially malicious websites)
Q4 - What is your proposed solution? (optional)
Simply treat all URIs the same. Let them always be clickable links that the browser evaluates as it can. Passbolt is not checking if the https:// link is valid, why should it check if the myapp:// link is valid?
Little extension to this but not quite the core of this request (but very related):
- why are links always displayed as buttons anyways? they open pages in new tabs, we have
target="_blank"
for that. if it were just a link, users could treat it like a link and for example ctrl+click/middle-mouse-button-click it so it opens in a different tab in the background (there’s probably a few posts about this already) - this is not a duplicate of [PB-33629] As a user I can define url schemes that open the relevant desktop app, my post is about general behavior of clicking a URI, the other one is about adding fields to them
- as I am writing this post, a user contacted me that the feature I am requesting here has actually been the standard in the extension popout until last week, but is now gone. I didn’t get to check patch notes yet
Q5. Community support
People can vote for this idea to show traction:
- Must have: this is critical for me to have this
- Should have: this is important for me to have this
- Could have: this could be nice to have
- Won’t have: we should not schedule this (explain why)