KidRoles for your IT team

Forced install: WebAppInstallForceList

Microsoft Edge and Google Chrome install the app silently, with no user action, once you set the WebAppInstallForceList policy. Users can’t turn it off or uninstall the app. The same value works in both browsers:

[{"url":"https://shop.kidroles.com/","default_launch_container":"window","create_desktop_shortcut":true}]

• "default_launch_container": "window" — the app opens in its own window, not in a tab.
• "create_desktop_shortcut": true — a desktop shortcut (Windows and Linux).
• The URL in the policy must be the final one, with no redirects — use exactly https://shop.kidroles.com/.
• Check on the computer: edge://policy or chrome://policy → “Reload policies”, then the app list at edge://apps / chrome://apps.

Edge doesn’t apply this policy to profiles signed in with a personal Microsoft account — use a work/school or local profile. Microsoft also doesn’t support PWAs in Edge in FSLogix environments (they disappear after sign-out).

https://shop.kidroles.com/

Windows: Intune and Group Policy (GPO)

• Intune — Edge: Devices → Configuration → new policy for Windows 10 and later, type “Settings catalog”. From the Microsoft Edge category add “Configure list of force-installed Web Apps”, enable it and paste the policy value.
• Intune — Chrome: in the same settings catalog, the Google Chrome category has the same setting; no ADMX import needed.
• GPO — Edge: after adding the Edge administrative templates (MSEdge.admx): Administrative Templates → Microsoft Edge → “Configure list of force-installed Web Apps”.
• GPO — Chrome: after adding the Chrome templates: Administrative Templates → Google → Google Chrome → “Configure list of force-installed web apps”.
• Registry (no domain or MDM): a REG_SZ value named WebAppInstallForceList under HKLM\SOFTWARE\Policies\Microsoft\Edge or HKLM\SOFTWARE\Policies\Google\Chrome.

Google Workspace and Chromebooks: in the Google Admin console go to Devices → Chrome → Apps & extensions → Users & browsers, add the app by URL and set it to force install. That also puts KidRoles on Chromebooks.

macOS and Linux

macOS: add the WebAppInstallForceList key to a configuration profile in your MDM (for example Intune or Jamf), in the com.microsoft.Edge or com.google.Chrome domain:

<key>WebAppInstallForceList</key>
<array>
  <dict>
    <key>url</key>
    <string>https://shop.kidroles.com/</string>
    <key>default_launch_container</key>
    <string>window</string>
  </dict>
</array>

Linux: Chrome reads policies from JSON files in /etc/opt/chrome/policies/managed/. Microsoft doesn’t list Linux among the platforms of this Edge policy — use Chrome there.

{
  "WebAppInstallForceList": [
    {
      "url": "https://shop.kidroles.com/",
      "default_launch_container": "window",
      "create_desktop_shortcut": true
    }
  ]
}

Kiosk mode

Mind the data: Microsoft Edge kiosk mode — including a Windows kiosk (Assigned Access) with Edge — runs an InPrivate session. When the browser closes or resets after inactivity, cashiers, products, coins and history are gone, and the app needs internet at every start.

For everyday play we therefore recommend a normal install (the policy above) on a shared computer account. Edge kiosk suits a demo or an open day, when every session should start from scratch:

msedge.exe --kiosk https://shop.kidroles.com/ --edge-kiosk-type=fullscreen --no-first-run

A kiosk that keeps the data is Chrome started with --kiosk on a normal profile: full screen without the address bar, and the data survives restarts. Close other Chrome windows first — the flag only applies when the browser starts fresh.

# Windows
"C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://shop.kidroles.com/
# macOS
open -na "Google Chrome" --args --kiosk https://shop.kidroles.com/
# Linux
google-chrome --kiosk https://shop.kidroles.com/

Set up a Windows kiosk in Settings → Accounts → Other users → “Set up a kiosk”, in Intune or with the PowerShell command Set-AssignedAccess. With Edge it runs in Edge kiosk mode, so the same InPrivate caveat applies.

Network and firewall

The app talks to a single address and loads nothing from other domains: no CDN, no Google Fonts, no ads and no analytics in the app. The only exception is an optional product-name suggestion, off by default (last point below).

https://shop.kidroles.com/    (HTTPS, 443)
wss://shop.kidroles.com/pair    (WebSocket, 443)

• The first launch needs internet — that’s when the browser saves the app (service worker). After that the till works offline and fetches updates when online.
• Pairing a phone as a scanner connects the till and the phone over the WebSocket wss://shop.kidroles.com/pair. Both devices need internet but don’t have to be on the same Wi-Fi. The server only passes scanned codes between them and doesn’t store them.
• A TLS-inspecting proxy must let WebSocket connections (the Upgrade header) through to this address — the simplest fix is adding shop.kidroles.com to the inspection exceptions. If WebSocket is blocked, only pairing stops working.
• A phone isn’t required: the computer’s or tablet’s camera scans codes too (the “Scanner” button in the Shop).
• Optional: https://world.openfoodfacts.org (HTTPS, 443) — only if a parent turns on “Suggest names from the internet (parent mode)” in Settings → Scanner. When a product is added after scanning its code, the app sends just the code there and gets the name from the Open Food Facts database. If the address is blocked, the name is typed in by hand; the rest of the app works as before.

Data and privacy

• No accounts or sign-in — children don’t enter names or email addresses; a cashier is an emoji or a photo stored locally.
• All data stays in browser storage (localStorage), in the user profile on that computer. Nothing reaches our server; the app has no ads and no tracking.
• Each browser profile and each system account is a separate shop. A group’s shared computer needs just one account — the children have their own cashiers inside the app.

These settings wipe the app’s data: ClearBrowsingDataOnExit (Edge), ClearBrowsingDataOnExitList (Chrome), BrowsingDataLifetime with the cookies_and_other_site_data type (Edge and Chrome), ForceEphemeralProfiles, session-only cookies (DefaultCookiesSetting = 4), as well as guest accounts and temporary profiles. Don’t apply them to computers running KidRoles, or check on one computer that cashiers and products survive a restart.

One catalog for the whole school: in edit mode, “Save catalog” writes the products to a file you load on the other computers (“Load catalog”).

Sources — Microsoft, Google and Apple documentation

• Microsoft Edge — WebAppInstallForceList
• Microsoft Edge — VideoCaptureAllowedUrls
• Microsoft Edge — ClearBrowsingDataOnExit
• Microsoft Edge — BrowsingDataLifetime
• Microsoft Edge — kiosk mode
• Microsoft Edge — PWA: install, manage, uninstall
• Windows — single-app kiosk (Assigned Access)
• Intune — settings catalog
• Google Chrome Enterprise — automatically install web apps
• Google Chrome Enterprise — BrowsingDataLifetime, ClearBrowsingDataOnExitList
• Google Chrome — use web apps
• Apple — use Safari web apps on Mac