Re: [w3c/manifest] Add id member to manifest (#988)

> The id is not exposed to the developers through API so there is no way to detect the id of your app, if a mal-intented app is trying to use the manifest id to carry the user ID for user tracking.

Thanks! Is the ID exposed in HTTP requests? Are there side channels such as "thing X will only happen if there's a matching manifest ID" where X can be a network load, a flag being set, an API returning a different value etc?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/pull/988#issuecomment-901512253