I create a test server domain named, e.g., https://pwa.test.com and put two PWAs:
https://pwa.test.com/app1
https://pwa.test.com/app2
I am using VueJS and in vue.config.js is possible to set base url to subfolder.
So both PWAs work gracefully in each subfolder. The problem is that they share the local and session storage, and this is a severe security issue.
The IndexedDB has a specific name for each app, but both are listed together.
How I can separate completely my apps?
I try use 'scope' in manifest.json, but this does not apply to storage.
Using the local storage, you are in charge of detecting which PWA is trying to reach the data. If you really need to use the same subdomain for both, you must also use different keys to identify the items in the local storage. The same applies to sessions.
The best solution would be to use different subdomains for the same application. Your browser should do the rest and store the information separately.