Re: [manifest] Obtaining a Manifest should follow usual CORS rules with credentials. (#353)

> if you look at facebook.com, amazon.com etc everything static is hosted on a CDN.

Hmm, OK. Facebook do already host a mozApps manifest at https://m.facebook.com/openwebapp/manifest.webapp - I have no idea how much of a challenge that was for them.

Same with:
* Twitter https://mobile.twitter.com/cache/twitter.webapp
* YouTube http://m.youtube.com/mozilla_youtube_webapp
* SoundCloud https://m.soundcloud.com/manifest.webapp

etc...

Overall I think hosting the manifest same-origin is a more scalable solution than the hoops I had to go through to verify my domain for an app I submitted to the Chrome Web Store, but I'm not doubting that it could be a challenge for some hosting setups.

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/pull/353#issuecomment-90924205