Re: [manifest] Obtaining a Manifest should follow usual CORS rules with credentials. (#353)

>  there are a huge number of runtime resolutions happening that need the page it was linked from to exist, specifically the start_url.

Can you expand on this a little? Obviously the start_url needs to exist in order to launch the app (that's true regardless of the relationship between the manifest and the page it was installed from). If the manifest is same-origin with the app then the start_url can just be resolved against the manifest URL, there's no need to involve the document it was installed from, which could be one of many URLs.

I would actually assume this resolution would happen at install time when processing the manifest, not at runtime. What other resolutions need to happen, and what prevents them being resolved against the manifest URL?

> My biggest hurdle is that I believe we (the web) need manifest to be able to not be forced to live on the same host as where it was linked from.

Are there more examples you can give of where this is problematic? Just trying to understand because this hasn't been a problem for Firefox OS so far.

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/pull/353#issuecomment-90911906