Re: [w3ctag/design-reviews] Web Install API - Cross-Origin (Issue #946)

Hola @hober, thanks for your feedback, we've been pondering about the implications of `navigator.install` for same/cross-origin installations and the requirement of an `id`. I've reviewed the current designs for the API and think some changes are needed to warrant consistency between the same/cross origin use case (this is a very valid point you bring up!) and futureproofing the API.

First, we want to make both use cases require an `id`. This doesn't have to be a manifest id, it could be any string that the developer uses to identify or refer to the content. If this is a cross-origin scenario for a web app, then highly likely this will be a manifest id. In a same-origin scenario, where there might not even be a manifest present, the developer could call the install method with an arbitrary `id` they give their content (i.e. `navigator.install('myinstallid123')`). If in the future they wanted to add a manifest file to that (non-app) content, they could do so and use the same string they used as an `id` and the app could continue updating without any issues. 

This resolves the concern in a way that makes the API consistent independent of the use case (same/cross-origin) and doesn't require the same-origin to-be-installed-content to have a manifest id or to be a web app. We believe it prevents developers from creating a bad app ecosystem as well.

In the case of cross-origin installations, the requirement is to be an installable app and to require a manifest due to bad actor potential and avoiding a bad site to install any URL. This is achieved by opting into the installation sources field, which is present in a manifest file. 

cc @amandabaker @dmurph 


 

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/946#issuecomment-2229146301
You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/946/2229146301@github.com>