Add configs for web application manifest files

[alrra]

Specification: http://w3c.github.io/manifest/
Browser support coming soon in: Chrome and Firefox

---

The web application manifest file:

• 1. Must be served with the correct Content-Type, namely: application/manifest+json.

  From http://w3c.github.io/manifest/#h3_obtaining-a-manifest:

  

  It seems we cannot reliably set the Content-Type from the .htaccess file, because:

  • if <link rel="manifest"...> is used, we can't know the exact location and name of the manifest file

  • if <link rel="manifest"...> is NOT used, the location of the manifest is assume to be /.well-known/manifest.json, but even this default location can't be (AFAIK) correctly matched from within the .htaccess file, as it requires the use of a directive such as <Location>, e.g.:

    <Location "/.well-known/manifest.json">
      AddType application/manifest+json json
    </Location>

    Also, doing something like:

    <Files "manifest.json">
      AddType application/manifest+jsonx json
    </Files>

    isn't a good default, as it will match all files with that specific name.

    So, we will just have to add a comment (with some examples), and let the user handle this part.

• 2. Can be served compressed (it's JSON, so it will compress quite nicely):

  <IfModule mod_filter.c>
      AddOutputFilterByType DEFLATE application/atom+xml \
                                    # ...
                                    application/manifest+json \
                                    # ...
  </IfModule>

• 3. Can be cached

  

  <IfModule mod_expires.c>
      # ...
      ExpiresByType application/manifest+json             "access plus 1 year"
      # ....
  </IfModule>

• 4. Can be UTF-8 encoded (already solved because the manifest file needs to have the file extension json or manifest):

  <IfModule mod_mime.c>
      AddCharset utf-8 .atom .css .js .json .jsonld .rss .vtt .webapp .xml
  </IfModule>

• 5. Should NOT be served with all the HTTP headers intended only for HTML documents (already solved because the manifest file needs to have the file extension json or manifest):

  <IfModule mod_headers.c>
      # ...
      <FilesMatch "\.(appcache|atom|crx|css|cur|eot|f4[abpv]|flv|gif|htc|ico|jpe?g|js|json(ld)?|m4[av]|manifest|map|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|tt[cf]|txt|vcf|vtt|webapp|web[mp]|woff|xml|xpi)$">
          Header unset Content-Security-Policy
          Header unset X-Frame-Options
          Header unset X-UA-Compatible
          Header unset X-XSS-Protection
      </FilesMatch>
  </IfModule>

• 6. Other (Which?)

[alrra]

@marcoscaceres can you take a look over my previous comment and tell me if I missed something? Feel free to ignore the Apache related technical details. Thanks!

[marcoscaceres]

(I'm at workshop this week, but will try to take a look on Friday - at first glance, I'm really excited to see this in h5bp!)

[marcoscaceres]

Just quickly:

1. Must be served with the correct Content-Type, namely: application/manifest+json.

This is not a "MUST" - just a recommendation. The obtainer doesn't enforce the MIME type, so serving it as JSON or whatever is fine.

About "./well-known/manifest.json", this is what my .htaccess file has to support this:

#Activate RewriteEngine
RewriteEngine On
# Redirect /.well-known URLs
RewriteRule .well-known/manifest.json /manifest.json

About encoding, I think it must be UTF-8 or I think JSON.parse() in the browser will reject it.

About 6. A CSP directive is forthcoming... working with the WebSec group on that... will prob. be: manifest-src. See w3c/manifest#207

[alrra]

@marcoscaceres Thanks for your comment, I sincerely appreciate it!

1. Must be served with the correct Content-Type, namely: application/manifest+json.

This is not a "MUST" - just a recommendation. The obtainer doesn't enforce the MIME type, so serving it as JSON or whatever is fine.

Thanks, I've updated the inline comments.

About "./well-known/manifest.json", this is what my .htaccess file has to support this...

I recently updated the configs to allow access to the visible content from within the /.well-known/ directory.

About encoding, I think it must be UTF-8

Already covered! :)

A CSP directive is forthcoming... working with the WebSec group on that... will prob. be: manifest-src. See w3c/manifest#207

We are only providing an example on how to set the CSP header, so as long as @mikewest updates the CSP specification (and maybe even the html5rocks article), we're good.

@marcoscaceres let me know if there is anything else I've missed.

[marcoscaceres]

LGTM! Thanks again.

[alrra]

@marcoscaceres thanks again!