Player and controlled display environment

Overview and explanation

The player provides a controlled environment for content on public or internal screens. Visitors use the designated application interface, while authorised users manage content in the administration interface.

Web content is rendered inside Runtime

Controlled rendering limits visitor controls, but does not replace the security of the embedded website or operating system. Returning the kiosk to its start screen does not itself end a visitor’s website login session.

• Image rendering: JCEF uses off-screen rendering rather than a separate browser window. Chromium produces rendered frames, which Runtime incorporates into its own graphical interface. Touch input travels in the opposite direction. The website is processed on the playback device, rather than streamed from the server as remote video.
• Touch events: The player mediates touch input. It converts clicks, scrolling and dragging into events passed to the web engine. The image is updated continuously; it is not a single static screenshot of a website.

Benefits for screen operators

• Visitor interface: Visitors see a website as part of the playback application, without the usual browser tabs or address bar. The website receives touch input through the playback application. This controls how visitors operate the public screen.
• New windows: The implementation intercepts requests to open new windows and sends permitted destinations to the existing view.
• Navigation: Navigation restrictions can also be configured.
• Files and system dialogs: The reviewed implementation does not normally handle the standard file selection dialog or direct printing to PDF. The precise effect depends on the feature and application variant. The web content can still retrieve documents through a dedicated handling path; this does not establish that all file downloads are blocked.

What kiosk protection covers and where it ends

The website still runs as a website: its JavaScript can handle buttons, retrieve data from APIs or communicate with other domains. Passing rendered frames to Runtime does not turn those activities into a harmless static image.

Navigation restrictions decide whether a page may open based on configured addresses. They are not a general filter for every network request made by the website. Embedded maps, scripts, images and data interfaces cannot therefore be assumed to be blocked by this setting alone.

A sandbox separates a program from its surroundings and restricts its permissions and resources. Hiding browser controls or rendering a website into an image does not establish that isolation. Treat the content as an active application and assess its network connections, sessions and permissions separately.

Sessions, cookies and inactivity

• Cookies and cache: JCEF uses a disk cache and can retain session cookies.
• Return after inactivity: Returning the kiosk to its start screen after inactivity is a separate feature. In the reviewed code path, that return does not clear cookies or automatically sign out of the embedded website.
• Sign-in and session termination: On a public device, visitor sign-in and session termination must therefore be designed into the particular web application.
• Device handover: Returning to the start screen is not equivalent to providing a clean user profile. The same consideration applies when transferring a device to another customer.

Camera, microphone and physical access

• Camera and microphone: Camera and microphone access depend on the application, operating system permissions and player version. Enabling a webcam does not establish whether an application only displays its image, records it or transmits it. Those operations must be described for the specific application. The existing maintenance guide explains how to enable camera access.
• Physical access: A physical keyboard, USB ports and operating system access provide a different level of control from the visitor’s touch interface. Access to them is addressed during installation and device administration. Ubuntu, the display environment and the applications are therefore shown separately in the architecture.