Support for mjs_extended_scope manifest member

[ghost]

Replace mjs_access_whitelist with mjs_extended_scope to make more clear the purpose of this setting (i.e. define multiple navigation scope rules).

[kenchris]

@boyofgreen Ah so it is not the scope which is extended. It is the scope for access to extra Windows APIs.

Why not having something like:

mjs_winrt_access_rule
mjs_winrt_access_scope

to show they belong together (name could be different)

[ghost]

Actually, it is extending scope. We believe that scope should support multiple origins (see this comment).

mjs_extended_scope allows specifying multiple navigation rules as an array of URL patterns. An URL matching any of these rules will open inside the app.

mjs_extended_scope: [
 "http://domain1.com",
 "http://domain2.com/*",
 "*://domain3.com"
]

Regarding API access rules (either for Windows or for any other platform) they should be specified in the mjs_api_access member.

[boyofgreen]

Yes, it's not completely unheard of to have an app that crosses domains. Fox news is a good example:
http://www.foxnews.com/manifest.json
This may not get used a lot, but we need to have some mechanism to allow it.

[marcoscaceres]

Although I complete agree, and have plenty of example sites that span multiple origins, in the past we received a lot of pushback from security folks about supporting cross-origin scopes.

I understand their concerns and I think we need to keep pushing on this, but we might need to raise this with the W3C Web Apps Sec WG and see if we can come up with something suitable. Multi-origin sites are a reality today (even if the navigation is as simple as changing sub-domains), so I also think we need to find a solution allowing cross-origin navigation. 

On November 26, 2015 at 1:16:52 AM, Jeff Burtoft (notifications@github.com) wrote:

Yes, it's not completely unheard of to have an app that crosses domains. Fox news is a good
example:
http://www.foxnews.com/manifest.json
This may not get used a lot, but we need to have some mechanism to allow it.

---

Reply to this email directly or view it on GitHub:
#183 (comment)

[boyofgreen]

@marcoscaceres I'll move this over to your GitHub repo, as I think about the end game for scope, and what an awesome experience it could become, I don't want to break that either. Potentially we need to consider a way to allows urls that are clicked within the app to be kept in the app experience, without needing them to be in the app scope.

[marcoscaceres]

@boyofgreen, sounds great... you probably saw I'm trying to kick off the discussion there too. I'm hoping to have better support in Firefox by early next year for web manifest, so that should help us understand the challenges better as we start consuming content. Note that next month things are going to slow down significantly because of holidays + a scheduled Mozilla event (which is happening all next week ).