W3C home > Mailing lists > Public > public-webapps@w3.org > April to June 2014

Re: [manifest] Update and call for review

From: Ben Francis <bfrancis@mozilla.com>
Date: Wed, 28 May 2014 11:43:28 +0100
Message-ID: <CADKQpGSsUMUKhvhsws9Av3BcK2E_CY_BDN4hg9-HOivquu3p2w@mail.gmail.com>
To: Anne van Kesteren <annevk@annevk.nl>
Cc: Marcos Caceres <w3c@marcosc.com>, public-webapps <public-webapps@w3.org>
On Wed, May 28, 2014 at 9:39 AM, Anne van Kesteren <annevk@annevk.nl> wrote:

> I don't understand this. That would you mean you'd have to modify the
> content of Gmail to point to this manifest. That sounds bad.
>

To quote Marcos:

The only way one could do what you describe would be for "my own app store"
> to host its own manifests. So:
> http://myownappstore.com/gmail/index.html
>
> Would contain:
> <link rel="manifest"
> href="http://myownappstore.com/gmail/manifest.json">
>
> Which would have:
>
> {
>    "name": "Gmail"
>    "start_url": "http://gmail.com"
> }
>
> This would allow custom stores that provide tailored "app experiences" for
> sites that lack manifests.
>

This is the scenario I was describing. Allowing this to happen has both
benefits (easy to build huge app stores!) and risks (easy to build "fake
apps").

But it sounds as though more people are arguing for the manifest URL and
start URL to be required to be same-origin as each other, which would
prevent this scenario from happening.
Received on Wednesday, 28 May 2014 10:43:57 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:14:24 UTC