Re: [w3ctag/design-reviews] Web Install API - Cross-Origin (Issue #946)

Hola @hober @plinss and @LeaVerou,

Thanks for your patience! In the app store use case, the developer must already have this information. Could be asked when an app is being submitted or previous information that someone wanting to link and install 3P apps can easily find out. For cross-origin installs, the installing origin needs to have the to-be-installed origin's manifest id beforehand. Part of the reason we prefer to have an id for the app instead of pointing to the manifest's URL is because this URL can change. The `id` does not point to a resource that can be navigated to. It is just a unique way to identify the application.

About CORS I think this is good feedback! I'd like to keep CORS functionality implementation open to a future/parallel expansion of Web Install for sure. To start though, CORS is a bit less developer friendly, and thinking about developer ergonomics I'd like to have the install origins definition not rely (only) on headers. 

If both CORS and manifest `install_sources` were to be supported in the future, do you see this as an acceptable solution? 

cc @amandabaker @dmurph


-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/946#issuecomment-2194947490
You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/946/2194947490@github.com>