[w3c/manifest] Should `display-mode` be gated for cross-origin iframes? (Issue #1239)

marcoscaceres created an issue (w3c/manifest#1239)

Split off from the `application-context` discussion in #1218.

`application-context` now evaluates to `none` unless a document is same origin with all of its ancestors up to the top-level traversable, so a cross-origin document (or one nested inside a cross-origin ancestor) can't observe whether the top-level context is an installed application.

`display-mode` has no such gating. A cross-origin iframe can call `matchMedia("(display-mode: standalone)")` and read the top-level page's display mode — in WebKit the media feature reads the page's applied manifest with no origin check, and the spec text doesn't restrict it either. That exposes essentially the same bit (is the top-level context standalone / installed?) to arbitrary third-party frames.

For consistency, and so `display-mode` isn't a trivial way to observe what `application-context` deliberately hides, should `display-mode` also evaluate to `browser` for cross-origin (or cross-origin-nested) documents?

There's a real compatibility cost: `display-mode` has shipped for years and embedded content may rely on reading it, so this likely needs use-counter data and cross-vendor input before any change. Filing to track the question.

cc @dmurph @benfrancis @kyerebo


-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/manifest/issues/1239
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/manifest/issues/1239@github.com>