Breaking: Change requirement to block off-scope navigation. #701

mgiuca · 2018-07-05T05:20:42Z

Previously, user agents were required to prevent off-scope navigation (or open it in a new top-level browsing context). Now, they are not allowed to do this, as it broke existing sites not designed to be run under these conditions.

Replaced with a recommendation to show the URL when off-scope.

Closes #646.

Preview | Diff

dominickng

Looks great to me. A few suggestions.

dominickng · 2018-07-05T05:33:12Z

index.html

+          Unlike previous versions of this specification, user agents are no
+          longer required or allowed to block off-scope navigations, or open
+          them in a new <a>top-level browsing context</a>. This practice broke
+          a lot of sites that navigate to a URL on another origin (e.g., to


Perhaps remove the "a lot of" qualifier?

dominickng · 2018-07-05T05:34:08Z

index.html

+          Unlike previous versions of this specification, user agents are no
+          longer required or allowed to block off-scope navigations, or open
+          them in a new <a>top-level browsing context</a>. This practice broke
+          a lot of sites that navigate to a URL on another origin (e.g., to


"to a URL on another origin" -> "to an off-scope URL" (since scope can be narrower than an origin)

dominickng · 2018-07-05T05:34:36Z

index.html

+          them in a new <a>top-level browsing context</a>. This practice broke
+          a lot of sites that navigate to a URL on another origin (e.g., to
+          perform third-party authentication), which would then navigate back to
+          the originating site. See


Remove everything from comma to full stop? Bug has more details.

dominickng · 2018-07-05T05:35:29Z

index.html

+            The <a>start URL</a> is not necessarily the value of the
+            <a data-link-for="WebAppManifest"><code>start_url</code></a> member:
+            the user or user agent could have changed it when the application
+            was added to home-screen or otherwise bookmarked.


"was added to...." -> "installed"?

OK, moved this to #702 since it's kind of off-topic for this breaking change.

mgiuca · 2018-07-05T07:17:54Z

I responded by completing all of your suggestions, @dominickng

kenchris · 2018-07-05T08:32:56Z

index.html

+        "!HTML#active-document">active document</a>'s <a data-cite=
+        "!DOM#concept-document-url">URL</a> is not <a>within scope</a> of the
+        navigation scope of the <a>application context</a>'s manifest, the user
+        agent SHOULD show prominent UI indicating the <a data-cite=


UI elements? UI just means user interface

kenchris · 2018-07-05T08:35:16Z

index.html

+        <a>origin</a>, including whether it is served over a secure connection.
+        This UI SHOULD differ from any UI used when the <a data-cite=
+        "!DOM#concept-document-url">document URL</a> is <a>within scope</a>, in
+        order to alert the user of the off-scope navigation.


I am not such a fan of "alert"

in order to make it obvious to the user that they are navigating off-scope.

kenchris · 2018-07-05T08:35:45Z

index.html

-          algorithm. As such, the following algorithm monkey patches [[!HTML]].
-          <a href="https://www.w3.org/Bugs/Public/show_bug.cgi?id=27653">Bug
-          27653</a> has been filed to address this.
+          Unlike previous versions of this specification, user agents are no


Already in a "NOTE" block (don't like redundantly writing "Note" everywhere).

kenchris · 2018-07-05T08:36:31Z

index.html

-          not to say that the web application cannot be navigated: just that
-          the set of URLs to which the manifest applies is restricted by the
-          <a>navigation scope</a>.
+          The above recommendation to show UI when the <a>application


is to show?

No, can you split up the sentence instead?

security -> security reasons?

The previous text did not match the way the HTML navigate algorithm works. The new text aligns with the wording in the HTML algorithm, while preserving the currently specified behaviour. The second part (attempting to capture redirects off-scope) is a little vague, but should capture the intention.

Previously, user agents were required to prevent off-scope navigation (or open it in a new top-level browsing context). Now, they are not allowed to do this, as it broke existing sites not designed to be run under these conditions. Replaced with a recommendation to show the URL when off-scope. Closes w3c#646.

mgiuca · 2018-07-10T03:02:02Z

Responded to @kenchris comments.

mgiuca · 2018-09-05T07:50:41Z

@dominickng and I have been talking and want to proceed with this. We're getting a lot of requests to fix our broken navigation within PWAs.

Chrome has already implemented this on Android, and we're committed to changing our Desktop implementation to match. However, none of the other major browsers do this. So we need a commitment from at least one other browser (Edge, Firefox, Safari) before we land this. @boyofgreen @marcoscaceres @davidquesada please give us your thoughts.

As we've discussed on #646, even though this change breaks the existing spec (which other browsers — including Chrome on Desktop — are implementing), what we're really doing is bringing PWAs in line with normal HTML navigations. Currently, user agents following the Manifest spec are forced to break the normal behaviour of target=self links on existing websites.

marcoscaceres · 2018-09-05T11:12:59Z

I'm personally supportive with the change, but I can't commit to implementation until next year 😢 Meeting with my colleagues from Mozilla in December to take stock of where we are at with a product strategy.

mgiuca · 2018-10-09T02:28:50Z

Hi @marcoscaceres. Thanks. I'll take your support and understand that you can't commit to implementing in Firefox until next year.

I haven't heard back from any of the others. I'd like to move forward with this change regardless because the current behaviour is untenable for us (we are constantly receiving reports about this).

I've compiled a document summarizing the issue with a list of reports we've gotten internally, and some external bug reports:
https://docs.google.com/document/d/1ZFItpUruPclnYechVkgXz9lVEwAK2Tuuo-592ohPpDo/edit

Since I've already got an approval from Ken, I'm going to merge this later today unless there are objections.

marcoscaceres · 2018-10-09T03:16:56Z

Go for it. Just please reach out to the Apple folks and make sure they are aware. I'm sure they are probably getting similar reports.

Previously, user agents were required to prevent off-scope navigation (or open it in a new top-level browsing context). Now, they are not allowed to do this, as it broke existing sites not designed to be run under these conditions. Replaced with a recommendation to show the URL when off-scope. Closes w3c#646.

…e theming. This further clarifies that a manifest is allowed to apply to URLs that are not within its scope (that this was not clear was a left-over mistake from w3c#701), and that a document within scope is allowed to override the theme color. Adds a new recommendation that an out of scope document not be allowed to override the theme color. This introduces new normative recommendations, only insofar as they were already commonly understood, to my knowledge. Navigation scope: No longer defined in terms of the URLs that a manifest is allowed to apply to (since a manifest may apply to any URL). Rather, it's just a set of URLs; the other normative requirements around navigation scope define what it means. Applied: Clarified that it is the user agent's discretion whether or not to apply a manifest when a top-level browsing context is created, with examples of when you would and would not apply it (previously, there was simply no text around when a manifest should be applied). Theme color: Fixes a "MAY" requirement imposed on the document (requirements can only be imposed on user agents). Clarifies this recommendation as only applying to in-scope documents, and adds a recommendation against applying document theme for out-of-scope documents. Closes w3c#755.

mgiuca mentioned this pull request Jul 5, 2018

Editorial: Attempt to fix the navigation scope monkey patching. #700

Closed

dominickng reviewed Jul 5, 2018

View reviewed changes

mgiuca mentioned this pull request Jul 5, 2018

Clarify rule of navigating away from the navigation scope #646

Closed

mgiuca force-pushed the off-scope-navigation branch 2 times, most recently from 32ccc73 to 83643d9 Compare July 5, 2018 07:17

kenchris reviewed Jul 5, 2018

View reviewed changes

kenchris added the breaking Use for changes that break existing normative behavior label Jul 5, 2018

mgiuca mentioned this pull request Jul 6, 2018

Added POST-and-redirect section to apps pages. benfredwells/killer-marmot#30

Merged

mgiuca added 3 commits July 9, 2018 16:57

Respond to dominickn review.

1dbac2e

mgiuca force-pushed the off-scope-navigation branch from 83643d9 to 1dbac2e Compare July 9, 2018 06:58

Wording.

ad78efa

kenchris approved these changes Jul 10, 2018

View reviewed changes

mgiuca mentioned this pull request Sep 25, 2018

<firebase-auth> fail to signInWithRedirect() from both mobile Chrome and installed PWA, after PWA is installed (i.e. Add to homescreen)? FirebaseExtended/polymerfire#332

Closed

8 tasks

mgiuca merged commit 4ff0609 into w3c:gh-pages Oct 9, 2018

mgiuca deleted the off-scope-navigation branch October 9, 2018 06:11

mgiuca mentioned this pull request Nov 1, 2018

Allow for multiple scopes #449

Closed

mgiuca mentioned this pull request Dec 4, 2018

Security Risks in Web App Off-scope Navigation #747

Closed

benfrancis mentioned this pull request May 27, 2020

Privacy Review: handle start_url tracking #399

Closed

mgiuca mentioned this pull request May 28, 2020

What theme color should be used when a PWA window is out of scope? #755

Open

mgiuca mentioned this pull request May 28, 2020

Clarify the definition of "navigation scope", "applied", and off-scope theming #880

Open

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Breaking: Change requirement to block off-scope navigation. #701

Breaking: Change requirement to block off-scope navigation. #701

mgiuca commented Jul 5, 2018 •

edited by pr-preview bot

Loading

dominickng left a comment

dominickng Jul 5, 2018

dominickng Jul 5, 2018

dominickng Jul 5, 2018

dominickng Jul 5, 2018

mgiuca Jul 5, 2018 •

edited

Loading

mgiuca commented Jul 5, 2018

kenchris Jul 5, 2018

kenchris Jul 5, 2018

kenchris Jul 5, 2018

mgiuca Jul 9, 2018

kenchris Jul 10, 2018

kenchris Jul 5, 2018

kenchris Jul 5, 2018

mgiuca commented Jul 10, 2018

mgiuca commented Sep 5, 2018 •

edited

Loading

marcoscaceres commented Sep 5, 2018 •

edited

Loading

mgiuca commented Oct 9, 2018

marcoscaceres commented Oct 9, 2018

Breaking: Change requirement to block off-scope navigation. #701

Breaking: Change requirement to block off-scope navigation. #701

Conversation

mgiuca commented Jul 5, 2018 • edited by pr-preview bot Loading

dominickng left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mgiuca Jul 5, 2018 • edited Loading

Choose a reason for hiding this comment

mgiuca commented Jul 5, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mgiuca commented Jul 10, 2018

mgiuca commented Sep 5, 2018 • edited Loading

marcoscaceres commented Sep 5, 2018 • edited Loading

mgiuca commented Oct 9, 2018

marcoscaceres commented Oct 9, 2018

mgiuca commented Jul 5, 2018 •

edited by pr-preview bot

Loading

mgiuca Jul 5, 2018 •

edited

Loading

mgiuca commented Sep 5, 2018 •

edited

Loading

marcoscaceres commented Sep 5, 2018 •

edited

Loading