Re: [manifest] Define identity of a web app. (#272)

> Doesn't this bypass the mechanism which is supposed to ensure that the start URL is same-origin with the page the app was installed from?

No. The start URL is resolved and forced same origin to the page the app was installed from. If that fails, you get the Document url. So, to update, you need to keep a record of the page where you installed from.  

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/272#issuecomment-97939891