restrict manifest to https ?

[laurentperez]

if a captive portal or a malicious MITM can replace the content of the manifest, it can masquerade a legit app icon (say, sms or contacts) on the user home screen

should the manifest be restricted to https context just like serviceworkers are ?

[marcoscaceres]

@laurentperez, I understand the concern, but I don't think so. This problem applies to any resource served over HTTP and banning the use of manifest to HTTPS seems like overkill. Unlike service workers, manifests don't have afford an attacker anything that elevates the privileges of a web application.

If we do #161 (integration with service workers) then, yes! One will need to serve manifest over HTTPS.