Re: [w3c/manifest] Add `application-context` CSS media feature (PR #1218)

marcoscaceres left a comment (w3c/manifest#1218)

Following a security review during WebKit implementation, I've moved `application-context` to an ancestor-chain origin check: a document observes the application context only if it and every ancestor up to the top-level traversable are same origin. This closes the case where a frame same-origin with the top, but nested inside a cross-origin frame (A→B→A′), would otherwise be observable. The spec text and WebKit implementation now reflect this.

Separately: `display-mode` currently exposes the `standalone` bit to cross-origin frames with no origin gating. I'll file a follow-up to consider tightening it for consistency — flagging here since it came up in the same review. @benfrancis @dmurph @kyerebo — shout if the ancestor-chain model looks wrong to you.


-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/pull/1218#issuecomment-5065779523
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/manifest/pull/1218/c5065779523@github.com>