Re: [w3c/manifest] Clarify how manifest image resources are fetched (PR #1171)

marcoscaceres left a comment (w3c/manifest#1171)

Checked implementations ahead of merging:

**Chrome** (`content/browser/manifest/manifest_icon_downloader.cc`): uses `WebContents::DownloadImageInFrame()` with an `initiator_frame_routing_id`, which ties the fetch to a specific renderer frame. CSP and service workers apply. Consistent with this algorithm.

**Firefox** (`dom/manifest/ManifestIcons.sys.mjs`): uses `aWindow.fetch(request)` with `mode: "cors"`, going through the content window. CSP and service workers apply. Consistent with this algorithm (though Firefox sets `mode: "cors"` explicitly, whereas the algorithm leaves mode unset).

**WebKit**: currently routes manifest image fetches directly to the network process via `NetworkDataTask` without setting a client/settings object, bypassing CSP and service worker interception. Filed https://bugs.webkit.org/show_bug.cgi?id=311872 to track the conformance gap.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/pull/1171#issuecomment-4218275947
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/manifest/pull/1171/c4218275947@github.com>