Re: [w3c/manifest] Add a unique identifier for a PWA (#586)

I don’t think this was addressed above—forgive me if it was—but what is to stop a bad actor from spoofing the `id` of another app? Do you think there should be an additional check in place? Maybe something like _origin_ + `id`? It would complicate things like domain migrations, but I feel like we could probably come up with a best practice for that as well.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/586#issuecomment-736150537