Re: [manifest] Obtaining a Manifest should follow usual CORS rules with credentials. (#353)

Hmm, ok.  I can certainly talk to the point about the relationship of the manifest location and the page it was discovered on.  

It seems like we are treating the manifest as a complete package that is standalone (i.e, I can read the manifest.json and work out exactly what to do with it) yet there are a huge number of runtime resolutions happening that need the page it was linked from to exist, specifically the start_url.  

My biggest hurdle is that I believe we (the web) need manifest to be able to not be forced to live on the same host as where it was linked from.

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/pull/353#issuecomment-90900602