Re: [w3c/manifest] Allow manifest processing to be invoked without going through an HTML document (PR #1069) from Aaron Gustafson on 2023-04-21 (public-webapps-github@w3.org from April 2023)

From: Aaron Gustafson <notifications@github.com>
Date: Fri, 21 Apr 2023 06:38:35 -0700
To: w3c/manifest <manifest@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <w3c/manifest/pull/1069/c1517849439@github.com>

@mgiuca Perhaps adding another RECOMMENDED to the [Privacy & Security Considerations](https://www.w3.org/TR/appmanifest/#priv-sec) section that recommends UAs that make use of Manifest files not bound to an HTML document apply the same rigor & protections they would under CORS? Since it's possible the Manifest could be part of a package, I'm not really sure what the mechanism should be. How does the Web Packaging spec deal with this?

As for the merge queue, I have no idea. I don't think I've paid attention to that before, I've mainly squashed (which I thought was what we had on this repo previously).

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/pull/1069#issuecomment-1517849439
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/manifest/pull/1069/c1517849439@github.com>

Received on Friday, 21 April 2023 13:38:40 UTC