A trend seen on the web today is to create a platform where externally developed applications can run inside some kind of main application. This is often done by providing an API to access data and business logic of your service and a sandbox environment in which third-party applications can run. By providing this, it is made possible for external developers to come up with new ideas based on your service. Some good examples on this are Spotify Apps, Apps on Facebook and SalesForce.com.

Ipendo Systems AB is a company that develops a web platform for intellectual properties. Currently most things on this platform are developed by developers at Ipendo Systems AB. Some interest has though risen to enable external developers to create applications that will in some way run inside the main platform.

In this thesis an analysis of already existing solutions has been done. These solutions were Spotify Apps and Apps on Facebook. The two have different approaches on how to enable third-party applications to run inside their own service. Facebook’s solution builds mainly on iframe embedded web pages where data access is provided through a web API. Spotify on the other hand hosts the third-party applications themselves but the applications may only consist of HTML5, CSS3 and JavaScript.

In addition to the analysis a prototype was developed. The purpose of the prototype was to show possible ways to enable third-party applications to run inside your own service. Two solutions showing this were developed. The first one was based on Facebook’s approach with iframing of external web pages. The second was a slightly modified version of Spotify’s solution with only client-side code hosted by the main application. To safely embed the client side code in the main application a sandboxing tool for JavaScript called Caja was used.

Of the two versions implemented in the prototype was the Iframe solution considered more ready to be utilized in a production environment than Caja. Caja could be seen as an interesting technique for the future but might not be ready to use today. The reason behind this conclusion was that Caja decreased the performance of the written JavaScript as well as adding complexity while developing the third-party applications.