Re: [manifest] Must manifests be same-origin? (#360)

Good question. Firefox OS currently prevents an application context being embedded inside a browsing context without a special permission, to prevent this kind of attack. Web content can always opt-out of their content rendering inside an iframe using an X-Frame-Options header, but maybe a more general protection is needed if this is a goal.

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/360#issuecomment-94435964