Re: [manifest] Obtaining a Manifest should follow usual CORS rules with credentials. (#353)

>  If the manifest is same-origin with the app then the start_url can just be resolved against the manifest URL, there's no need to involve the document it was installed from, which could be one of many URLs.

I get that, but at the same time you could have the full URL if needed and that solves a lot of the issues.

My concern is that we can't deploy this on to CDN's and we have a lot of history with developers for whom deploying to CDN is far far easier than storing files on a server.  We've had issue like this for domain verification on google.com/webmasters it is just a hard experience to get new files deployed on domain.  I can't say the individual partners and developers, but if you look at facebook.com, amazon.com etc everything static is hosted on a CDN.

Other things as well are an issue, I can't be on my http site and link to my manifest on https and have that launch the https version of the site.

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/pull/353#issuecomment-90918611