Re: [w3c/manifest] Clarify behaviour of a page linking to a manifest that is not within scope of that manifest (#784)

From an offline discussion with @dominickng : I'm pseudo-convinced that we should _allow_ the installation from an off-scope page of a manifest that is on the **same origin**.

We identified two separate use cases for why you might want to do this as a site owner:

1. A site contains an index of PWAs that exist in sub-paths of the index page. For example, our test site [Killer Marmot](https://killer-marmot.appspot.com) contains an index page (which is not a PWA) linking to many sub-paths which are individually scoped PWAs. In this case, you have links to many manifests for all of the sub-PWAs, which can be installed from the index page.
2. A site has a separate PWA implementation, because they don't (at least initially) want to move all of their main site traffic over to a service worker, etc, they have a main site at https://example.com/ and a separate PWA site at https://example.com/pwa. They still want to promote installation of their PWA from https://example.com, which would result in the installation of https://example.com/pwa. In this case, you have a single manifest link --- to the /pwa subsite, and the user agent allows it to be installed from the main page.

We determined that number 1 is not a valid use case. It wouldn't even work, since you can't have multiple installable manifests and there's no way for the site UI to trigger installation of a specific one. This is an interesting use case (a "PWA app store") which we should explore in the future, but through a dedicated API for installing a specific manifest, and likely with an associated permission.

However, number 2 seems like a reasonable use case. While we ideally want developers to make their main site the PWA, the reality is that large websites are understandably hesitant to move all of their traffic over to a new architecture, so having a separate "beta PWA" site seems to be pretty normal practice.

Thus, we propose that:

1. We explicitly allow the linking to a manifest from a document that is not in scope of that manifest, and allow installation of that manifest to be triggered.
2. We explicitly *ban* the manifest from having any other effect on the out-of-scope document (e.g., setting its theme colour, etc), via a new paragraph in the [authority of the manifest's metadata](https://www.w3.org/TR/appmanifest/#authority-of-the-manifest-s-metadata) section.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/784#issuecomment-529329623