Support data URI or local files for icon images? about pwabuilder-cli

Actually, supporting icons from URLs that are not the parent/app site would be helpful too.

[nbellocam]

Thanks for making this suggestion. I added to the backlog.

[boyofgreen]

Hey Voltages,
The more I think about your idea the more I like it. However I did some research and there is no indication that the spec will support that, and we are trying to stay within the scope of the manifest for the input. Would you like us to propose this to the spec working group? We will follow up with them either way

[marcoscaceres]

It should work, as that's controlled by CSP... so, so long as the CSP policy allows it, it should be doable 👍

[marcoscaceres]

(having said that, I've not tested it in any implementations... I recommend trying this idea maybe in Chrome)

[boyofgreen]

I'll try it out and see what I can find. My worry was with the whatwg icon spec and it's "external resource" text. I might just be reading too much into the wording though. If it's within the scope of the spec and especially if it's initial implementation supports it, we will add support.
I want to be cautions that ManifoldJS doesn't move some place contrary to the spec, as one of the goals is to increase adoption of the spec by both devs and user agents.

[marcoscaceres]

In the latest draft of the W3C manifest spec, we've removed the association with link rel=icon (i.e., they are now completely different things and serve completely different purposes: the link rel=icon of a page is for that page; while the icons member in the manifest are for the application).

Can you clarify a bit more about what your concerns are? From an browser perspective, where one acquires the icon from is determined by the interaction of Fetch and CSP - so if there is nothing in the CSP preventing fetching and processing a data: URL, then it should be no problem (so long as the format is one supported by the underlying OS)

[boyofgreen]

Actually if you have removed the association with the link icon spec, that I have no concerns. I was trying to reconcile the two but I have always felt like the link icon spec was a bit "old world".
I like your tie it with CSP as well, I feel like we should make that part of the docs to encourage devs to implement CSP whenever enabling access to APIs (I think FFOS does this by design, but not a requirement for win10 or the Cordova pollyfilled apps)

[kenchris]

According to the Microsoft Edge Web Platform Summit, packaged apps on Win 10 will have a default CSP policy:

script-src: ms-apps: data: 'unsafe-eval'; style-src ms-appx: data: 'unsafe-inline' object-src 'none'; font-src ms-appx: data:;

(local content is loaded through ms-appx-web:///)

[marcoscaceres]

Having said that, one should never explicitly write "ms-appx-web:///" in an app.

[colinfindlay-nz]

Is there an update on this? I'm trying to build a Cordova app with ManifoldCordova and was quite surprised that even file:// isn't supported.