Re: [w3c/manifest] Security Risks in Web App Off-scope Navigation (#747)

Ultimately, I think we have to treat this as a product decision that each user agent can make individually. There doesn't have to be agreement in the spec about how internal links are opened. Firefox could, for example, open all links in a browser tab and never allow off-scope pages to be viewed inside the app.

I think it's reasonable to work towards adding a feature to the manifest like `stay_in_app` as a hint, where developers can say "I need these URLs to stay in the app for my app to work properly", and then put "SHOULD" or even "MUST" text in the spec to keep those URLs inside the app, and have "MAY" text for other URLs. Then, hypothetically, Chrome could ignore `stay_in_app` and open all off-scope URLs inside the app, while Firefox opens `stay_in_app` URLs inside the app but other URLs in a browser. Both would be compliant.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/747#issuecomment-635689815