PowerPoint Presentation

App ManifestBy S. M. Mohi-Us SunnatWhat is an App Manifest?The app manifest provides information about an app (such as name, author, icon, and description) in a simple document usable by both users and app stores. Most importantly, it contains a list of Web APIs that your app needs. This allows users to make informed decisions about apps before installing them. It is one of the key things that distinguishes an Open Web App from a website.

What is an App Manifest?Name: manifest.webapp (you must use the .webapp extension)Location: your app's root directoryFormat: JSON (must be valid JSON)Path HandlingFor Packaged and Hosted appPath must be served from thesame originas the app.

Packaged App/myapp/index.html/myapp/manifest.webapp

Hosted apphttp://www.mysite.com/myapp/index.htmlhttp://www.mysite.com/myapp/manifest.webapp

RequirementsIf you want to publish your app to the Firefox Marketplace, your app manifest must contain the following fields:Manifest File Sample

What was that???

He He HeNow we have WebIDE"version": 1.0,

"chrome": { "navigation": true },

"fullscreen": "true,

"orientation": [ "landscape-primary" ]

"installs_allowed_from": [ "https://marketplace.firefox.com"],

"locales": { bn-BD": { "name": ", "description": "},

"permissions": { "alarms": { "description": "Required to schedule notifications" }},

"appcache_path": "/cache.manifest"Some Useful FieldsCPS (Content Security Policy)What is a CSP?Content Security Policy(CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware.If a CSP is specified in theApp Manifest, the specified CSP and the default CSP for the app's type will be merged. A specified CSP may not loosen restrictions of the default CSP. The Firefox Marketplace Validator detects violations of the CSP during the app submission process. This can be used to help find problems early in development.

CSP in ManifestAdd this in the manifest file

"csp" : "default-src *; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline

Privileged CSP

default-src *; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline

Certified/Internal CSP

default-src *; script-src 'self'; object-src 'none'; style-src 'self'Applicable CSP RestrictionsYou cannot include scripts inline in your HTML.

onclick="" or onload="