FAQs about app manifests

 

 

Le manifeste application fournit des informations utiles sur une application (comme le nom, l'auteur, l'icône et la description) dans un document simple utilisable par les utilisateurs et app stores. Plus important encore, il contiendra une liste des API Web (comme la géolocalisation) que votre application a besoin. Cela permet aux utilisateurs de prendre des décisions éclairées sur les applications avant de les installer.

Why does my app need an app manifest?

The app manifest provides useful information about an app (such as name, author, icon, and description) in a simple document usable by both users and app stores. Most importantly, it will contain a list of Web APIs (such as geolocation) that your App needs. This allows users to make informed decisions about apps before installing them.

Is the Open Web app manifest the same thing as the manifest used for Google Chrome extensions and installable web apps? Or the W3C Widgets manifest? Or the HTML5 cache manifest?

No to all of these. The Open Web app manifest is probably most similar to the Google manifest, but they are not identical. It is hoped that the Open Web apps manifest will become a standard.

What is an origin?

The origin of an app is the protocol, domain, and port of the URL together. Each of the following URLs is a different origin:

• https://example.com
• https://example.com:8080 (different port)
• https://example.com (different protocol)
• https://www.example.com
• https://myapp.example.com (subdomain)

The following URLs are the same origin:

• https://Example.com:80
• https://example.com

The following URLs are the same origin:

• https://example.com/drawingApp
• https://example.com/notesApp

Why do I have to host the app manifest at the same origin as my app?

We assume that only you can host an app manifest at the same origin as your app. This means your users can install your app with confidence, knowing that the installation is based on your app manifest and not someone else's. Users should have this confidence whether they're installing your app from Firefox OS Marketplace, from some other app store, or from your own website if you are self-publishing your app.

If the app manifest were not hosted at the same origin as the app itself, there would be nothing to prevent third parties from making apps directly out of content hosted at your origin. Even worse, third parties could create an app manifest using your branding that would trick users into installing an app that was a facade for stealing passwords or other improper behavior.

Does this mean I can't embed images or JavaScript from other origins?

No. The origin restriction is on content (HTML pages) only. Images and other embedded resources can be located elsewhere (for example, on a content delivery network), except for the app's icon, which must be served from the app's origin.

Can I have more than one app at my origin?

No, there can be only one app per origin. If multiple apps were allowed for a single origin, they would live in a single web sandbox -- they could examine each other's localStorage, do Ajax requests to each other's APIs, or even steal access to privileged APIs that should have been granted to only one of the apps. This would be especially dangerous for domains that publish user-generated content from many users.

We recommend that you use a separate subdomain for each of your apps. For example, spreadsheet.mycoolapps.com for one app and texteditor.mycoolapps.com for another. For more information, see Adding a subdomain for an app.

Many resources and permissions on the Web are already scoped to a single origin. By defining an app and an origin as the same thing we use the same security restrictions that are used elsewhere on the Web and in HTML5.

Why not just upload the app manifest directly to the Firefox OS Marketplace?

There are several benefits to hosting the manifest at your domain and providing the app manifest URL to the Marketplace:

• We intend that the Marketplace (and other app stores) will periodically revisit all the app manifests at the provided URLs and check them for updates. This avoids the need for you to re-upload your app manifest for each update.
• The Marketplace will pass both the original app manifest contents as well as its URL to the user's device. This allows the device to check for unexpected changes in the app manifest that might indicate tampering. This will be especially important for apps that use Web APIs (for geolocation for example).

Note: As of this writing, we are still designing a process by which the Marketplace will pass an updated app manifest to the user's device.

Why does my Web server have to use the proper HTTP Content-Type header when serving my app manifest?

This restriction prevents users of a website that allows user-generated content (for example, a pastebin site) from inadvertently or inappropriately claiming that entire website as their app.

Should I use HTTPS to serve my app manifest?

Yes, it is a good idea. We anticipate that the Firefox OS Marketplace will require any app using Web APIs (such as geolocation) to serve its app manifest over HTTPS as an additional defense against man-in-the-middle attacks. If you use HTTPS for your manifest, you must also use it for all the pages on your site.

What if someone else submits my app to the Firefox OS Marketplace?

In the unfortunate event that someone guesses the URL to your app manifest and submits it to the Firefox OS Marketplace before you do, please file a complaint with the Marketplace support team.

See also

App manifest