You assume the client side code is served by the middleman. But it can also be a browser based "app" that is loaded from the hdd. Unfortunately Chrome et.al has taken a step away from this model and deprecated app manifest (? cant remember the proper name) in favour of the more convenient service worker that is able to push updates in the background. Serverless/offline web apps didnt really take off. Theres ChromeOS and FirefoxOS for feature phones. But "web apps" for desktop are currently nw.js/Electron apps. It would however be just fine to use the local browser and not ship an entire browser with the web app. Most browsers allow "chromeless" mode (without address bar etc). But there needs to be a more relaxed security mode when running code as an app. Because its almost useless now with CORS and some features requiring SSL which you cant have when loading from hhd.