Re: [w3c/manifest] Need to specify client of image objects when fetching... (#465)

Moving @annevk's comments from #443 here... 

> Yeah, maybe that's better. Although it's a little weird since you can be associated with multiple documents, right?

Not necessarily. The perhaps short-sighted view is that "installation" and downloading of the icons is based on a single active Document... 

> And that document might disappear and then another one might appear?

If the Document vanishes, then the installation process would stop (this is not currently captured in the spec). 

> Would that mean you get a new policy?
> How does CSP work today for manifest resources?

It uses the Document's security principle, respecting `img-src`.  See:
https://w3c.github.io/manifest/#content-security-policy-of-image-objects   

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/465#issuecomment-215013709

Received on Wednesday, 27 April 2016 08:45:05 UTC