Re: [manifest] Obtaining a Manifest should follow usual CORS rules with credentials. (#353)

>Obviously the start_url needs to exist in order to launch the app (that's true regardless of the relationship between the manifest and the page it was installed from).

No. As is specced currently, start_url may not exist. The UA can use the page from which the manifest was linked to as the "entry point".

> If the manifest is same-origin with the app then the start_url can just be resolved against the manifest URL, there's no need to involve the document it was installed from, which could be one of many URLs.

Another solution is to allow start_url to be absolute URL.

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/pull/353#issuecomment-90917479