Re: [manifest] Define identity of a web app. (#272)

@jmajnert wrote:
> The manifest can either be a collection of supplementary information about an app (or apps), or a document defining one application. It can't be both. We should decide which way we want it to go.

Yes, we discussed this and concluded that Mozilla's position is that it should define one application.

> As with every piece of tech, you can use it in ways that the creators didn't plan for and possibly shoot yourself in the foot.

True, developers could try to create multiple apps with the same manifest (e.g. with the same name, icon and start_url), it's just likely to fail to install. So we should recommend against that.

> Was this discussion public and written down somewhere? Can I see it?

Unfortunately not on this occasion, but happy to answer any questions.

> Wondering how that will help? Merely making manifest same origin with the app?

As I understand it the idea is that the manifest URL authoritatively identifies an app, so the user wants to be sure that foo.com can not create a manifest for bar.com which it has no relationship with. This also makes it possible to resolve the start_url against the manifest URL rather than the document URL, though I don't think the spec says that yet. The manifest URL is used to reason about and to update the app so multiple apps with the same manifest URL can not be installed.

In building APIs for Firefox OS we've found many instances where apps need to be referred to by some globally unique identifier. Manifest URL makes a great identifier.

Manifest URL also makes a convenient identifier for search engines which can crawl the web for apps via link relations and know that a linked manifest is an authoritative description of an app.

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/272#issuecomment-78954632