Open sicking opened 11 years ago
It's very inconvenient for developers any time cross-origin communication is involved. For example all XHR loads require the server to support CORS, and you can't access the DOM or JS functions inside an which contains a cross-origin webpage.</p> <p>Right now a packaged app is cross-origin to all http:// loaded pages. That means that the developer is exposed to all the cross-origin restrictions even when talking to their own website.</p> <p>We should make it possible for a app package to choose a particular http:// origin that they are same-origin with. However, we have a number of problems to overcome:</p> <ul> <li>App packages don't always come from trusted sources. So we can't simply stick a "origin" property in the manifest and take it at face value.</li> <li>For privileged apps, we can't let script from the website be able to get access to the APIs that are granted to the privileged app.</li> <li>We might want to be able to "side load" app packages through people sharing apps using bluetooth or usb. At least for apps that are willing to be sharable this way.</li> <li>This should work even in situations when the user installs the app through a store and not through the developer website. This might not mean that the app package file is downloaded from the store webserver though.</li> </ul> </div> </div> <div class="page-bar-simple"> </div> <div class="footer"> <ul class="body"> <li>© <script> document.write(new Date().getFullYear()) </script> Githubissues.</li> <li>Githubissues is a development platform for aggregating issues.</li> </ul> </div> <script src="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"></script> <script src="/githubissues/assets/js.js"></script> <script src="/githubissues/assets/markdown.js"></script> <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/highlight.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/languages/go.min.js"></script> <script> hljs.highlightAll(); </script> </body> </html>
It's very inconvenient for developers any time cross-origin communication is involved. For example all XHR loads require the server to support CORS, and you can't access the DOM or JS functions inside an