Re: [w3c/manifest] Allow for multiple scopes (#449)

Some thoughts:
* eTLD is a pain for implementers because it requires a suffix list like https://publicsuffix.org/ (although this is already needed for other browser features anyway)
* Site *would* allow for the use case of a mail inbox at mail.google.com with a login page at accounts.google.com or an inbox at snt152.mail.live.com  with a login page at login.live.com
* A single site *wouldn't* accommodate the use case of an inbox at mail.google.com with a login page at accounts.google.com but an unrelated app at calendar.google.com
* Site still *wouldn't* accommodate the use case of youtube.com with a login page at accounts.google.com or a search at s.taobao.com with a results page at detail.tmall.com/item.htm
* Site + scope still *wouldn't* accommodate the use case of a web app at www.linkedin.com with an unrelated page at www.linkedin.com/company which shouldn't be within the scope of the manifest
* Site + scope still *wouldn't* accommodate the use case of an informational web page at www.evernote.com and an app at www.evernote.com/Home.action

It's true that using "site" could cater for a few additional use cases, but its interaction with scope seems a little unpredictable and clumsy.

I suggested some alternative solutions here https://docs.google.com/document/d/1fOsQWOOVuKyqO7cXZoKmxZGQ9FLgLMwmCRw3OEqIKrQ/edit#

Basically what we have now:
```
{
  "start_url": "/foo",
  "scope": "/foo"
}
```

A more comprehensive solution (still doesn't cover multiple deep-linkable origins):

```
{
  "start_url”: “http://foo.com/",
  "scope": {
    "include": ["/foo", "/bar"],
    "exclude": ["/baz", "/qux"]
  },
  "stay_in_app": ["http://norf.com"]
}
```

A middle ground:

```
{
  "start_url": "http://foo.com/bar",
  "scope": ["/bar", "/baz"],
  "stay_in_app": ["http://qux.com"]
}
```
Another approach might be an array of scopes which can span multiple origins but only within the same eTLD.

```
{
  "start_url": "http://foo.com/bar",
  "scope": [ "http://foo.com/bar", "http://baz.foo.com"]
}
```

Of course there's no guarantee that because someone has control over one origin in an eTLD that they own them all. Do we want evil.github.io capturing scope for w3c.github.io?

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/449#issuecomment-215050209