Re: [w3c/manifest] Clarify how manifest image resources are fetched (PR #1171)

marcoscaceres left a comment (w3c/manifest#1171)

@nicola-nicola (Dan) re: the mode question — the "fetching an image resource" algorithm currently doesn't set a fetch mode, which defaults to `no-cors`. Looking at implementations:

- **Firefox** explicitly sets `mode: "cors"` when fetching manifest icons.
- **Chrome** fetches through the document frame via `DownloadImageInFrame` (internal mode handling).

From a security and privacy perspective, `cors` is the right default: without it, a manifest author can silently cause every visitor's browser to make cross-origin requests to arbitrary servers (leaking IP, timing, `Referer`), without those servers' consent. This is functionally a tracking pixel mechanism via the manifest.

I've filed https://github.com/w3c/image-resource/pull/50 to set `mode` to `cors` in the "fetching an image resource" algorithm.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/pull/1171#issuecomment-4219191566
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/manifest/pull/1171/c4219191566@github.com>