Re: [manifest] URL Scope to which the manifest applies (#114)

To throw something else into the mix...

The scope of Service Workers is "restricted by the path of the Service Worker script unless the Service-Worker-Scope: ... header is set." [1]

We could follow the example of Service Workers and make the maximum scope of a manifest be the path of the manifest file (i.e. the same directory). This would prevent an app on a shared hosting site (e.g. http://example.com/~jack/manifest.json) from registering to manage URLs of another app (e.g. http://example.com/~jill/index.html). We could even go as far as to make this the default scope, though that would again not be backwards compatible with some content. I believe this is basically how Amazon web app manifests handle scope [2] and it's a pretty neat solution.

1. https://infrequently.org/2014/12/psa-service-workers-are-coming/
2. https://developer.amazon.com/appsandservices/community/post/Tx1VQ8CDCS8T3O2/Creating-and-Updating-your-Web-App-Manifest

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/114#issuecomment-66779937