Re: [w3c/manifest] Install button on another domain (#726)

I think in principle having an API to install another manifest (essentially, similar to beforeinstallprompt, allowing you to trigger an app install prompt, but for a different origin's manifest) is OK. It would be consistent with the values of the web for browsers to allow third-party "broker" sites to install other apps.

We'd have to be very careful from a security standpoint that you are not being spoofed. For a start, that means the install dialogs would need to show (in a browser-controlled way) the origin of the site being installed.

> The browser will prompt the user "Do wou want to install this app to your homescreen" anyway, which means, that the user really wants it. There is no need to say it twice.

That's somewhat reasonable, but I would possibly want some defense-in-depth here and also require the user to accept a permission to install sites. Otherwise any site could suddenly start popping up prompts to install malicious web apps.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/726#issuecomment-428775863