Xbap's are .NET 3.0 WPF smart client applications that are hosted by the browser – IE 6 or IE 7 only at this point. It’s an ugly name XBAP… pronounced x-bap.

XBAP is actually the extension of the file that you navigate your browser to in order to launch the application.  XBAP stands for XAML Browser Application… but that opens up a can of worms… again, it’s an ugly name.

Here’s a quick summary of the worms: 

Even though XBAP stands for XAML Browser Application, It’s not really a "XAML application", it’s a WPF smart client application.  XAML is just the programming model.  IMHO, you can call a standards Web application an “HTML application”, but you can’t call a WPF application an “XAML application” - it just confuses people still trying to get a handle on what XAML is.    Here’s why:  You likely – but not necessarily – used XAML to define the user interface of the XBAP and then you built your application, which means the XAML was compiled and wrapped up into a .NET EXE – bye-bye XAML.  

Then  when you publish the application, a ClickOnce application manifest and a ClickOnce deployment manifest get generated for that EXE.   The ClickOnce deployment manifest is an XML file that describes the deployment and serves as the launching point for a ClickOnce application and guess what… with WPF, that deployment manifest is give the extension of .XBAP (this deployment manifest in a Windows Forms ClickOnce published application is given the extension of .Application – not to be confused with the  application manifest that is also generated by a ClickOnce publish and given the extension of .Manifest – that’s right, another can of worms, for another day)

… so we call these applications “XBAP’s” – and I need to just learn to deal with it :)

Above I said that XBAP’s are “hosted by the browser”, what the heck does that mean?  It means that when you navigate to a URL that points to an XBAP, or find yourself on a page that has an IFrame whose source property is set to that same URL – the WPF smart client application will be launched inside the browser’s frame, it will look like you navigated to just another web page, but instead you are running a WPF smart client application.  No install step, no shelling out to a separate top level window on the desktop, the browser is the top level window.    The first time you go to this “page”, you’ll see a quick progress bar that indicates the WPF app is being downloaded to the machine – but subsequent trips to the same page will pull the application from cache.   And of course when a new version is deployed up to the server, then you’ll get the download again - for the parts that changed.

It's easy to immediately see the security risk here, a full blown smart client app running on my machine at the click of a link?.  Don't worry, XBAP's run in the sandbox, they only have internet or intranet zone permissions to the local machine (depending on the URL they are launched from) and as such have a limited set of capabiities.  In trusted line of business application scenarios it is easy to elevate these permissions though.  The XBAP manifests have to be signed with a cert that is installed on the client machine as a trusted publisher, then the XBAP can get elevated permissions.  If the cert is not installed on the local machine as a trusted publisher though, you won't see a permission elevation dialog - the app will just not run.

In order for XBAP's to launch hosted by the browser, .NET 3.0 has to be installed on the machine.  If you’re using IE 7 and .NET 3.0 is not installed on the machine, it will prompt you and then download and install it… but make no mistake, this is not a light plug-in experience like having to install an ActiveX control to get a web page to work, this is a 40mb or so download that requires local admin rights to install.  So my point here is, don’t think about an XBAP as requiring a download to run, think about an XBAP as a smart client application that requires the .NET 3.0 platform on the local machine.

So, once you’ve gotten over the hurdle of being limited to the Windows .NET 3.0 platform (even though you're hosted by the browser) – I think you’ll find that XBAP’s are very cool.  They are a fundamental piece of the WPF vision: it’s deployment story.

Accruent, an ISV in the retail and enterprise real estate business, has built a WPF smart client that is tightly integrated into their web portal solution and it is deployed as an XBAP.  They have created an application experience that combines the best of the capabilities of a web app with the best of the capabilities of a smart client and the typical workflows of a Microsoft Office user.  Check out this Channel 9 video to see Accruent's app and get a really good idea for how XBAP’s can work in LOB App scenarios.  It’s kind of a long video, but it’s worth it – it is a very powerful demonstration of the possibilities of combining Office, portal and WPF smart client solutions into a cohesive whole that enables the work force.

This note from Tim Sneath contains a good summary of a few other resources for getting your head around XBAP's, including a few cool sample apps and the blogs of 2 PM's on the WPF product team at Microsoft responsible for XBAP related features.