- What is NPAPI?
- What is NPAPI used for?
- Why are NPAPI plug-ins being phased out?
- What are other browsers doing?
- Is WebKitGTK following suit?
Here’s a tl;dr list of bullet points:
- NPAPI is an old mechanism to extend the functionality of a web browser. It is time to let it go.
- One year ago, WebKitGTK 2.26.0 removed support for NPAPI plug-ins which used GTK2, but the rest of plug-ins kept working.
- WebKitGTK 2.30.x will be the last stable series with support for NPAPI plug-ins at all. Version 2.30.0 was released a couple of weeks ago.
- WebKitGTK 2.32.0, due in March 2021, will be the first stable release to ship without support for NPAPI plug-ins.
- We have already removed the relevant code from the WebKit repository.
- While the WPE WebKit port allowed running windowless NPAPI plug-ins, this was never advertised nor supported by us.
What is NPAPI?
In 1995, Netscape Navigator 2.0 introduced a mechanism to extend the
functionality of the web browser. That was NPAPI, short for Netscape Plugin
Application Programming Interface. NPAPI allowed third parties to add
support for new content types; for example Future Splash (
which later became Flash (
When a NPAPI plug-in is used to render content, the web browser carves a hole in the rectangular location where content handled by the plug-in will be placed, and hands off the rendering responsibility to the plug-in. This would end up calling call for trouble, as we will see later.
What is NPAPI used for?
A number of technologies have used NPAPI along the years for different purposes:
- Displaying of multimedia content using Flash Player or the Silverlight plug-ins.
- Running rich Java™ applications in the browser.
- Displaying documents in non-Web formats (PDF, DjVu) inside browser windows.
- A number of questionable practices, like VPN client software using a browser plug‑in for configuration.
Why are NPAPI plug-ins being phased out?
The design of NPAPI makes the web browser give full responsibility to plug-ins: the browser has no control whatsoever over what plug-ins do to display content, which makes it hard to make them participate in styling and layout. More importantly, plug-ins are compiled, native code over which browser developers cannot exercise quality control, which resulted in a history of security incidents, crashes, and browser hangs.
Today, Web browsers’ rendering engines can do a better job than plug-ins, more securely and efficiently. The Web platform is mature and there is no place to blindly trust third party code to behave well. NPAPI is a 25 years old technology showing its age—it has served its purpose, but it is no longer needed.
The last nail in the coffin was Adobe’s 2017 announcement that the Flash plugin will be discontinued in January 2021.
What are other browsers doing?
Glad that you asked! It turns out that all major browsers have plans for incrementally reducing how much of NPAPI usage they allow, until they eventually remove it.
Let’s take a look at the Firefox roadmap first:
|Version||Date||Plug-in support changes|
|47||June 2016||All plug-ins except Flash need the user to click on the element to activate them.|
|52||March 2017||Only loads the Flash plug‑in by default.|
|55||August 2017||Does not load the Flash plug‑in by default, instead it asks users to choose whether sites may use it.|
|56||September 2017||On top of asking the user, Flash content can only be loaded from
|69||September 2019||The option to allow running the Flash plug-in without asking the user is gone.|
|85||January 2021||Support for plug-ins is gone.|
In conclusion, the Mozilla folks have been slowly boiling the frog for the last four years and will completely remove the support for NPAPI plug-ins coinciding with the Flash player reaching EOL status.
Chromium / Chrome
|Version||Date||Plug-in support changes|
|?||Mid 2014||The interface to unblock running plug-ins is made more complicated, to discourage usage.|
|?||January 2015||Plug-ins blocked by default, some popular ones allowed.|
|42||April 2015||Support for plug-ins disabled by default, setting available in
|45||September 2015||Support for NPAPI plug-ins is removed.|
|55||December 2016||Browser does not advertise Flash support to web content, the user is asked whether to run the plug-in for sites that really need it.|
|76||July 2019||Flash support is disabled by default, can still be enabled with a setting.|
|88||January 2021||Flash support is removed.|
Note that Chromium continued supporting Flash content even when it already removed support for NPAPI in 2015: by means of their acute NIH syndrome, Google came up with PPAPI, which replaced NPAPI and which was basically designed to support Flash and is currently used by Chromium’s built-in PDF viewer—which will go away also coinciding with Flash being EOL, nevertheless.
On the Apple camp, the story is much easier to tell:
- Their handheld devices—iPhone, iPad, iPod Touch—never supported NPAPI plug-ins to begin with. Easy-peasy.
- On desktop, Safari has required explicit approval from the user to allow running plug-ins since June 2016. The Flash plug-in has not been preinstalled in Mac OS since 2010, requiring users to manually install it.
- NPAPI plug-in support will be removed from WebKit by the end of 2020.
Is WebKitGTK following suit?
In March 2021, when the next stable release series is due, WebKitGTK 2.32 will remove the support for NPAPI plug-ins. This series will receive updates until September 2021.
The above gives a full two years since we started restricting which plug-ins can be loaded before they stop working, which we reckon should be enough. At the moment of writing this article, the support for plug-ins was already gone from the WebKit source the GTK and WPE ports.
Yes, you read well, WPE supported NPAPI plug-ins, but in a limited fashion: only windowless plug-ins worked. In practice, making NPAPI plug-ins work on Unix-like systems required using the XEmbed protocol to allow them to place their rendered content overlaid on top of WebKit’s, but the WPE port does not use X11. Provided that we never advertised nor officially supported the NPAPI support in the WPE port, we do not expect any trouble removing it.