Skip to content

Commit 7174064

Browse files
authored
Update references to link capturing and launch handling (#85)
1 parent a30eced commit 7174064

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

scope_extensions-explainer.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -79,14 +79,14 @@ associated origins.
7979

8080
## Security Considerations
8181

82-
### Declarative link capturing events
83-
84-
Capturing user navigations via `"capture_links": "existing-client-event"` has
85-
the potential for the web app to spoof its associated origins. Event link
86-
capturing must not be supported for associated origins unless they specify
87-
`"authorize": ["intercept-links"]` in their entry for the associated web app.
88-
This opt-in is used as a signal of trust between the associated origin and the
89-
web app.
82+
### [Launch handling params](https://github.com/WICG/web-app-launch/blob/main/launch_handler.md)
83+
84+
If an URL in extended scope is captured by an app that has
85+
launch_handler: { client_mode: "focus-existing" } set in its manifest, the URL
86+
is made visible to the app through Window.launchQueue instead of causing a top
87+
level navigation. Without scope_extensions, this URL must be from the same
88+
origin as the app scope. With scope_extensions, this exposed URL can be from a
89+
different origin within extended scope.
9090

9191

9292
## Future extensions

0 commit comments

Comments
 (0)