Skip to content

[Web Install] Cross-origin case w/o manifest shouldn't be able to assign an arbitrary manifest_id #864

Open
@jyasskin

Description

@jyasskin

I see a discussion from @dmurph in https://docs.google.com/document/d/19dad0LnqdvEhK-3GmSaffSGHYLeM0kHQ_v4ZRNBFgWM/edit that sites should be installable without a manifest, and therefore the install() API should require an app ID. I think that interacts badly with the cross-origin install API, where the other origin shouldn't be able to assign an arbitrary ID without the installed site's consent.

Metadata

Metadata

Assignees

Labels

Web Install APIDeclarative install for web apps from a web app.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions