Re: [w3c/manifest] Should manifest be HTTPS only? (#887)

> Agree - although we could make that case that if no one reads the manifest except over HTTPS, then the spec would match reality.

See above edit: Chrome reads manifest over HTTP if the user explicitly installs the app.

There are other possible uses of the manifest besides new tab page, just to get higher quality assets for a website, and if there are no explicit security reasons to ban it, I would like to permit it. "motivating incentive to be HTTPS" isn't a strong enough reason; you could apply that to anything.

So I think we should keep this as an installation requirement (either explicit in the spec, or just enforced by browsers), not a requirement for fetching.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/887#issuecomment-636635086