Introduction to HTML Applications (HTAs) | Internet Development Index |
The power to build HTML Applications (HTAs) brings Microsoft® Internet Explorer 5 to the fore as a viable Microsoft Windows® development platform. HTAs are full-fledged applications. These applications are trusted and display only the menus, icons, toolbars, and title information that the Web developer creates. In short, HTAs pack all the power of Internet Explorer—its object model, performance, rendering power, protocol support, and channel-download technology—without enforcing the strict security model and user interface of the browser.
- Why Use HTAs
- Creating an HTA
- The Power of Trust: HTAs and Security
- Compatibility
- HTA Deployment
- Conclusion
- Related Topics
Why Use HTAs
Historically, programming languages like C++ and Microsoft Visual Basic® have provided the object models and access to system resources that developers demand. With HTA it is now time to add Dynamic HTML (DHTML) with script to that list. HTAs not only support everything a Web page does—namely HTML, Cascading Style Sheets (CSS), scripting languages, and behaviors—but also HTA-specific functionality. This added functionality provides control over user interface design and access to the client system. Moreover, run as trusted applications, HTAs are not subject to the same security constraints as Web pages. As with any executable file, the user is asked once, before the HTA is downloaded, whether to save or run the application; if saved to the client machine, it simply runs on demand thereafter. The end result is that HTAs runs like any executable (.exe) written in C++ or Visual Basic.
HTAs are suited to many uses, whether you are prototyping, making wizards, or building full-scale applications. Whatever DHTML and script deliver now—forms, multimedia, Web applications, HTML editors, and browsers—so can HTAs...and then some. Best of all, HTAs make some tasks easier. The simplicity of generating prototypes using HTAs makes it possible for program managers and designers to script dialog boxes and alerts while the C++ or Visual Basic developers program the underlying functionality.
Creating an HTA
Create an HTA by writing an HTML page and saving it with the .hta extension. It is that simple!
This sample demonstrates the simplest possible HTA. It consists of the string, "Hello, World", and is saved with the .hta extension. Internet Explorer is so forgiving that even the missing html and body tags do not cause an error. The program can be closed by pressing alt+f4.
Hello, World
To launch an HTA , double-click its program icon, run it from the Start menu, open it through a URL, or start it from the command line. Once running, the HTA renders everything within the paired body tag and displays the value set in the title tag as the window title.
HTA-Specific Functionality
Where the .hta extension tells the system how to handle the application, the new HTA:APPLICATION tag and attributes tell the window how to behave as an application. This tag exposes a limited set of attributes—attributes that control everything from border style to the program icon and its menu. The majority are read-only and have default values optimized for the average application. To comprise a valid HTA, this tag must appear within the paired head tags.
The HTA:APPLICATION tag in this example specifies application features not available in DHTML. As prescribed by the attributes, this application has neither border (border), nor title bar (caption), nor standard program icon (sysMenu). The application title appears in the Windows task list but not in the taskbar (showInTaskBar), and only one instance of the application is permitted to run at a time (singleInstance). When launched, the HTA is known to the system as "monster" (applicationName) and initially is sized to fill the screen (windowState). For a full list of attributes and properties, and links to more information about each, see HTML Applications Reference. The program can be closed by pressing alt+f4.
<HEAD> <TITLE>My Monster Application</TITLE> <HTA:APPLICATION ID="oMyApp" APPLICATIONNAME="monster" BORDER="none" CAPTION="no" ICON="/graphics/creature.ico" SHOWINTASKBAR="no" SINGLEINSTANCE="yes" SYSMENU="no" WINDOWSTATE="maximize"> </HEAD>
Many of the HTA-specific properties that affect the user interface of the window are interdependent. When sysMenu is set to no, not only the program icon, but also the Minimize and Maximize buttons are disabled. When border is set to none, neither the window border, program icon, title bar, nor Minimize and Maximize buttons display. Finally, when caption is set to no, the Minimize and Maximize buttons, the program icon, and the window border are disabled. These contingencies all make sense in the light of standard Windows graphical user interface design.
The Power of Trust: HTAs and Security
As fully trusted applications, HTAs carry out actions that Internet Explorer would never permit in a Web page. The result is an application that runs seamlessly, without interruption.
In HTAs, the restrictions against allowing script to manipulate the client machine are lifted. For example, all command codes are supported without scripting limitations (see command id). And HTAs have read/write access to the files and system registry on the client machine.
The trusted status of HTAs also extends to all operations subject to security zone options. In short, zone security is off. Consequently, HTAs run embedded Microsoft ActiveX® controls and Java applets irrespective of the zone security setting on the client machine. No warning displays before such objects are downloaded and run within an HTA.
HTA windows can extend the trust relationship to content in other domains. HTAs allow cross-domain script access between window objects and cookies. To address the security risks inherent in cross-domain scripting, HTA enables the APPLICATION attribute for frames and iframes. This HTA-only attribute is not the sole security precaution available. HTAs are designed such that frames and iframes, where the APPLICATION attribute is set to no />, have no script access to the HTA containing them. In this way, no unsecure content is allowed into an HTA through an untrusted window.
HTAs are designed such that untrusted HTML?B>frames and iframes have no script access to the HTA containing them. In the case of frames that are not HTA-enabled, the highest level frame comprises the top window for all frames it contains. For that frame, window.top and window.self are one and the same. In addition, unsafe frames and iframes receive neither a referrer nor an opener URL from the parent HTA. The end result is that they are unaware of the containing HTA as the parent window.
In applications where all content is safe, frames and iframes can safely be marked as trusted. Wizards and control panels are examples of safe content. The HTA-enabled status of the iframe in the example below permits it to pass information back to its parent window.
<IFRAME SRC="filename.htm" APPLICATION="yes">
By contrast, an iframe that allows browsing to unsecured content must be implemented as regular HTML. Content in the iframe example below is subject to the security setting for its zone. The following iframe can be used when embedding HTML.
<IFRAME SRC="filename.htm" APPLICATION="no">
When running HTAs, users should take the same precautions as with any executable: Only install HTAs produced by reliable sources. HTAs cannot be code-signed. However, they can be installed from signed cabinet (.cab) files or other signed installation formats. Either way, the most accountable sources will be corporate intranets and established software vendors.
Compatibility
The Microsoft implementation of HTA is limited to Windows 32-bit systems running Internet Explorer 5. HTAs do not support the HTML AutoComplete in forms feature, or the external object.
HTA Deployment
The HTA implementation supports multiple deployment methods: the Web model, the package model, and a hybrid of the two. Application developers should decide how best to meet their distribution needs.
The Web Model
The Web deployment model consists of an application that can be run and administered just like a Web page. In this scenario, the HTA is launched simply by browsing to its URL or by accessing it from the Internet Explorer Favorites list. Before launch, an Internet Explorer dialog box presents the user with the choice to open or save the application. After launch, ancillary application components are downloaded from the server as needed and then cached. Servers must have the MIME type "application:hta" registered for delivery through the http: protocol to work.
This model boasts some important strengths. It facilitates seamless updates: The intranet administrator need only post the new code or content for the client to receive the latest version. It provides ease of use: The user need never install or uninstall the application. Unused applications are automatically flushed from the cache. One important consideration when evaluating this deployment model is that server-based applications cannot be run offline or when the server goes down. One option is to anticipate this eventuality by implementing the advanced channel (CDF) features in Internet Explorer 4.0 and later. For more information, see the Introduction to Active Channel Technology.
The Package Model
In the package deployment model, the installation process for the HTA is the same as for traditional applications. Files are copied from disk or over a network, using any installer or self-extracting executable. The installer places the application in the Program Files directory or in the directory selected by the user. A link to the HTA is included in the Start menu. And the application's dependency on Internet Explorer 5 or greater is registered. This way the user is warned that uninstalling Internet Explorer will disable that application. Look to tools vendors for vehicles for packaging and delivering HTAs to your specifications.
Like the Web model, the package model has points in its favor. The user is prompted only during the initial installation about trusting the application; thereafter, the application runs as trusted code just as an .exe does. Also, the installed HTA is always available to users, whether they are connected to the server or not.
Hybrid Deployment Models
Any combination of Web and package deployment models is feasible. The method of delivery is transparent to the HTA. HTA components are always referenced as URLs, absolute or relative, so the applications simply work.
Examine Your Priorities
What are your distribution needs? The following list presents just a few scenarios.
- If keeping the initial download time brief is paramount, then hybridize by installing the top window of the HTA onto the client machine, leaving the HTA to access the server for images and support files.
- If your users run the application both at work and remotely, consider deploying HTAs over the local network using the Web model while also distributing it for remote use using the package model.
- Perhaps your business requires a tool where the content is maintained by separate groups and is distributed across servers. The application will look and function like a unified whole if you create a single user interface and use Web deployment automatically to deliver the latest information.
Conclusion
No matter what the delivery model, using Internet Explorer as your development platform is a compelling way to build applications large and small.