Re: [w3c/manifest] scope="../" should be invalid (#551)

What @pkotwicz describes is the exact challenges that Service Worker also had for their scope. I know the two are different, but given that the scope affects the navigational context, the app gets special privileges not normally afforded to web apps (URL interception in particular).

It gets a little harder because the location of the manifest could reasonably be on a CDN and the manifest scope processing doesn't include the document URL other than for checking the scope is on the same origin as the document. Step 4 and 6 are at conflict in this process.

I'm not clear on the interplay between the scope and the start_url, I've (maybe mistakenly) been thinking that the base url gets affected based on the scope whichs means the start_url is relative to that to the scope and the scope can be either defined or inferred by the location of the manifest. I think there needs to be some clarity about what defines a web app.

There is a note that implies this, but I don't read it that clearly in the spec

>For example, if the value of start_url is ../start_point.html, and the manifest's URL is https://example.com/resources/manifest.webmanifest, then the result of URL parsing would be https://example.com/start_point.html.

I've tried to document combinations of start url and manifest url to make it clearer in my head about what is desireable

|  **manifest url** | **start_url** | **scope attr** | **calculated scope** | **caluclated start_url** | **valid?** |
|  ------ | ------ | ------ | ------ | ------ | ------ |
|  /tech-today/manifest.json | ./index.html | undefined | /tech-today/ | /tech-today/index.html | valid |
|  /tech-today/manifest.json | ./index.html | ../ | / | /index.html | valid - but scope leaks to higher level |
|  /tech-today/manifest.json | / | / | / | /index.html | valid - but scope leaks to higher level |
|  /tech-today/manifest.json | / | undefined | /tech-today/ | / | invalid - start url out of scope |
|  /tech-today/manifest.json | ./tech-today/index.html | undefined | /tech-today/ | /tech-today/tech-today/index.html | valid - but undesired |
|  /manifest.json | ./tech-today/index.html | undefined | / | /tech-today/index.html | valid - broad scope |
|  /manifest.json | /tech-today/index.html | tech-today | /tech-today/ | /tech-today/index.html | valid - tight scope |


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/551#issuecomment-278299292