nes - Dave's Blog


JavaScript Microsoft Store app StartPage

2017 Jun 22, 8:58

JavaScript Microsoft Store apps have some details related to activation that are specific to JavaScript Store apps and that are poorly documented which I’ll describe here.

StartPage syntax

The StartPage attributes in the AppxManifest.xml (Package/Applications/Application/@StartPage, Package/Applications/Extensions/Extension/@StartPage) define the HTML page entry point for that kind of activation. That is, Application/@StartPage defines the entry point for tile activation, Extension[@Category="windows.protocol"]/@StartPage defines the entry point for URI handling activation, etc. There are two kinds of supported values in StartPage attributes: relative Windows file paths and absolute URIs. If the attribute doesn’t parse as an absolute URI then it is instead interpreted as relative Windows file path.

This implies a few things that I’ll declare explicitly here. Windows file paths, unlike URIs, don’t have a query or fragment, so if you are using a relative Windows file path for your StartPage attribute you cannot include anything like ‘?param=value’ at the end. Absolute URIs use percent-encoding for reserved characters like ‘%’ and ‘#’. If you have a ‘#’ in your HTML filename then you need to percent-encode that ‘#’ for a URI and not for a relative Windows file path.

If you specify a relative Windows file path, it is turned into an ms-appx URI by changing all backslashes to forward slashes, percent-encoding reserved characters, and combining the result with a base URI of ms-appx:///. Accordingly the relative Windows file paths are relative to the root of your package. If you are using a relative Windows file path as your StartPage and need to switch to using a URI so you can include a query or fragment, you can follow the same steps above.

StartPage validity

The validity of the StartPage is not determined before activation. If the StartPage is a relative Windows file path for a file that doesn’t exist, or an absolute URI that is not in the Application Content URI Rules, or something that doesn’t parse as a Windows file path or URI, or otherwise an absolute URI that fails to resolve (404, bad hostname, etc etc) then the JavaScript app will navigate to the app’s navigation error page (perhaps more on that in a future blog post). Just to call it out explicitly because I have personally accidentally done this: StartPage URIs are not automatically included in the Application Content URI Rules and if you forget to include your StartPage in your ACUR you will always fail to navigate to that StartPage.

StartPage navigation

When your app is activated for a particular activation kind, the StartPage value from the entry in your app’s manifest that corresponds to that activation kind is used as the navigation target. If the app is not already running, the app is activated, navigated to that StartPage value and then the Windows.UI.WebUI.WebUIApplication activated event is fired (more details on the order of various events in a moment). If, however, your app is already running and an activation occurs, we navigate or don’t navigate to the corresponding StartPage depending on the current page of the app. Take the app’s current top level document’s URI and if after removing the fragment it already matches the StartPage value then we won’t navigate and will jump straight to firing the WebUIApplication activated event.

Since navigating the top-level document means destroying the current JavaScript engine instance and losing all your state, this behavior might be a problem for you. If so, you can use the MSApp.pageHandlesAllApplicationActivations(true) API to always skip navigating to the StartPage and instead always jump straight to firing the WebUIApplication activated event. This does require of course that all of your pages all handle all activation kinds about which any part of your app cares.


Application Content URI Rules rule ordering

2017 Jun 1, 1:30

Application Content URI Rules (ACUR from now on) defines the bounds on the web that make up a Microsoft Store application. The previous blog post discussed the syntax of the Rule's Match attribute and this time I'll write about the interactions between the Rules elements.


A single ApplicationContentUriRules element may have up to 100 Rule child elements. When determining if a navigation URI matches any of the ACUR the last Rule in the list with a matching match wildcard URI is used. If that Rule is an include rule then the navigation URI is determined to be an application content URI and if that Rule is an exclude rule then the navigation rule is not an application content URI. For example:

Rule Type='include' Match=''/
Rule Type='exclude' Match=''/

Given the above two rules in that order, the navigation URI is not an application content URI because the last matching rule is the exclude rule. Reverse the order of the rules and get the opposite result.


In addition to determining if a navigation URI is application content or not, a Rule may also confer varying levels of WinRT access via the optional WindowsRuntimeAccess attribute which may be set to 'none', 'allowForWeb', or 'all'. If a navigation URI matches multiple different include rules only the last rule is applied even as it applies to the WindowsRuntimeAccess attribute. For example:

Rule Type='include' Match='' WindowsRuntimeAccess='none'/
Rule Type='include' Match='' WindowsRuntimeAccess='all'/

Given the above two rules in that order, the navigation URI will have access to all WinRT APIs because the last matching rule wins. Reverse the rule order and the navigation URI will have no access to WinRT. There is no summation or combining of multiple matching rules - only the last matching rule wins.

PermalinkCommentsapplication-content-uri-rules programming uri windows windows-store

Application Content URI Rules wildcard syntax

2017 May 31, 4:48

Application Content URI Rules (ACUR from now on) defines the bounds of the web that make up the Microsoft Store application. Package content via the ms-appx URI scheme is automatically considered part of the app. But if you have content on the web via http or https you can use ACUR to declare to Windows that those URIs are also part of your application. When your app navigates to URIs on the web those URIs will be matched against the ACUR to determine if they are part of your app or not. The documentation for how matching is done on the wildcard URIs in the ACUR Rule elements is not very helpful on MSDN so here are some notes.


You can have up to 100 Rule XML elements per ApplicationContentUriRules element. Each has a Match attribute that can be up to 2084 characters long. The content of the Match attribute is parsed with CreateUri and when matching against URIs on the web additional wildcard processing is performed. I’ll call the URI from the ACUR Rule the rule URI and the URI we compare it to found during app navigation the navigation URI.

The rule URI is matched to a navigation URI by URI component: scheme, username, password, host, port, path, query, and fragment. If a component does not exist on the rule URI then it matches any value of that component in the navigation URI. For example, a rule URI with no fragment will match a navigation URI with no fragment, with an empty string fragment, or a fragment with any value in it.


Each component except the port may have up to 8 asterisks. Two asterisks in a row counts as an escape and will match 1 literal asterisk. For scheme, username, password, query and fragment the asterisk matches whatever it can within the component.


For the host, if the host consists of exactly one single asterisk then it matches anything. Otherwise an asterisk in a host only matches within its domain name label. For example, http://* will match but not or And http://*/ will match,, and However the Store places restrictions on submitting apps that use the http://* rule or rules with an asterisk in the second effective domain name label. For example, http://*.com is also restricted for Store submission.


For the path, an asterisk matches within the path segment. For example,*/c will match and but not or

Additionally for the path, if the path ends with a slash then it matches any path that starts with that same path. For example, will match and, but not

If the path doesn’t end with a slash then there is no suffix matching performed. For example, will match only and no URIs with a different path.

As a part of parsing the rule URI and the navigation URI, CreateUri will perform URI normalization and so the hostname and scheme will be made lower case (casing matters in all other parts of the URI and case sensitive comparisons will be performed), IDN normalization will be performed, ‘.’ and ‘..’ path segments will be resolved and other normalizations as described in the CreateUri documentation.

PermalinkCommentsapplication-content-uri-rules programming windows windows-store

Tweet from David Risney

2017 Jan 19, 12:51
Playing The Witness again after seeing an area I hadn't visited in the Xbox trailer. Listening to a lot of Hall of the Mountain King now...

Tweet from CodePen.IO

2016 Oct 8, 6:19
Pure CSS Minesweeper! 

Tweet from David Risney

2016 Aug 18, 5:40
Mother Jones on ending private prisons and their previous piece inside private prisons: 

Tweet from The A.V. Club

2016 Jun 6, 4:50
BuzzFeed backs out of RNC ad deal, citing profound awfulness of Donald Trump 

Retweet of NiemanLab

2016 Feb 3, 4:30
Public radio staffers across the U.S. lay out new guidelines for the "Wild West” of podcast audience measurement …

Tweet from David_Risney

2016 Jan 31, 11:27
Combat bad drones? NL police have attack eagles. Better than JP police drones w big nets? …

Tweet from David_Risney

2016 Jan 27, 10:28
Identify coder from binary based on code style. … Following company style guidelines is now a privacy issue.

Tweet from David_Risney

2016 Jan 27, 9:57
FCC proposes replacing cable card with software based equivalent. Would be amazing if it could happen. …

Retweet of FakeUnicode

2016 Jan 3, 10:26
I mean, look at this crap. All these full-alphabet variants "Because math!" @asrivkin @PlanetDr @lukedones @grierja

Retweet of justinkan

2016 Jan 3, 8:57
This seems like the way car ownership declines …

Tweet from David_Risney

2015 Dec 23, 9:23
Doctor Who rerun on after watching Jessica Jones. The Doctor suddenly seems so sinister. Don't read the psychic paper!

Tweet from David_Risney

2015 Dec 20, 11:32
FAA Grounds ‘Uber for Planes’ … via @motherboard

Tweet from David_Risney

2015 Dec 11, 3:14
Big drones with nets capture smaller drones in Tokyo no-fly zone. But where does it end?! …

Tweet from David_Risney

2015 Nov 18, 8:29
Next up: hacking phones with inaudible sounds that exploit bugs in this software …

Retweet of zeynep

2015 Oct 14, 6:11
Ran into Alex Halderman recently. He casually said "we found a weakness in Diffie-Hellman." My jaw dropped. GO READ. …

Tweet from David_Risney

2015 Oct 12, 9:31
Auto generating clickbait articles via neural network: …. And the result: 

Tweet from David_Risney

2015 Sep 20, 8:45
Do you think VW maliciously evaded US emission requirements? As a dev, can't imagine working on such a project. …
Older Entries Creative Commons License Some rights reserved.