Re: [w3ctag/design-reviews] Review origin policy. (#127)

@triblondon I'm not sure what you're saying above, but I *think* we agree. 

Origin policy is currently defined to be loaded before a browser interacts with a site:

> User agents can be instructed to synchronously download and process this manifest before completing a navigation to an origin’s resources, ensuring that the policy contained therin will be safely applied to each resource, and allowing the server to skip the overhead of including the relevant headers with each response. Typically, the server can speed things up even more by using HTTP/2 Server Push ([RFC7540], section 8.2) to proactively send the manifest file along with the response to the user agent’s first request.

Since it's on the critical path for a first page load, it's performance-critical, and I'd be wary of putting information in it that isn't necessary for that purpose. 

AFAICT, Manifest's use cases can be met by loading something synchronously in the background, or upon a user interaction that triggers needing it. It doesn't need to be in OP, and indeed might hurt there. 

It might make sense to reuse OP's syntax and processing, but separate out Manifest's use cases into a separate resource whose load time is tailored to Manifest's use cases.

I'd also caution against making OP a directory of every possible interaction with the origin (e.g., putting links to other things in it); that will cause bloat pretty quickly.


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/127#issuecomment-298269885