1401208 - Change default scope handling for standalone mode

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: Web Apps (PWAs), enhancement)

Description

[James Willcox (:snorp) ([e-mail]) (he/him)]

The web manifest spec states that if the scope is undefined, then all navigations should be considered in-scope[0]. Later on it says that if scope is undefined in a non-browser display mode, it is "recommended that user agents signal to the end-user when security and/or privacy sensitive navigations occur". Chrome handles this by showing the mini urlbar, which is also what it does for out-of-scope navigations. We should handle this by dumping out to Custom Tab. I propose we simply change the default scope to be the parent of the start_url.

[0] https://www.w3.org/TR/appmanifest/#navigation-scope

Comment 1

[James Willcox (:snorp) ([e-mail]) (he/him)]

Marcos, do you have an opinion on this?

Comment 2

[James Willcox (:snorp) ([e-mail]) (he/him)]

Attachment: Bug 1401208 - Change default web app scope to the start_url

Review commit: https://reviewboard.mozilla.org/r/181322/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/181322/

Comment 3

[Eugen Sawin [:esawin]]

Comment on attachment 8909815 [details]
Bug 1401208 - Change default web app scope to the start_url

https://reviewboard.mozilla.org/r/181322/#review186542

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/50d08bf45f3d
Change default web app scope to the start_url r=esawin

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/50d08bf45f3d

Comment 6

[Marcos Caceres [:marcosc]]

> I propose we simply change the default scope to be the parent of the start_url.

Sorry, I'm not sure what "the parent of the start_url" means exactly. I'm going to assume you mean the origin. 

I seem to recall there was issues with using "origin" if a developer had two applications hosted on the same domain:

foo.com/app1/ (fullscreen)
foo.com/app2/ (mininal-ui)

However, we can still experiment to see what is best, and them work with the Chrome folks to update the spec to match.

Comment 7

[James Willcox (:snorp) ([e-mail]) (he/him)]

(In reply to Marcos Caceres [:marcosc] from comment #6)
> > I propose we simply change the default scope to be the parent of the start_url.
> 
> Sorry, I'm not sure what "the parent of the start_url" means exactly. I'm
> going to assume you mean the origin. 

I mean if the start_url is foo.com/app1/foo.html, we would use foo.com/app1 as the default scope. Maybe origin is better, though.

> 
> I seem to recall there was issues with using "origin" if a developer had two
> applications hosted on the same domain:
> 
> foo.com/app1/ (fullscreen)
> foo.com/app2/ (mininal-ui)
> 
> However, we can still experiment to see what is best, and them work with the
> Chrome folks to update the spec to match.

In that case the developer can just set the scope explicitly to avoid any problems.

Comment 8

[Marcos Caceres [:marcosc]]

I did a bit more digging about the state of the discussions around scope (I've been focusing on Payments, so haven't paid much attention to manifest in the last year). 

In: 
https://github.com/w3c/manifest/issues/551

Google folks had proposed using the "parent directory" (this isn't really a viable thing in URLs, so I don't think that will work)... however, in the end, they didn't end up changing anything.

However, 551 above does provide some good input into the discussion.