Confirmed users
209
edits
WebAPI/WidgetAPI: Difference between revisions
→Prop If a widget navigates to those pages not listed in widgetPages, the widget iframe cannot use any APIs which requires permissions.osal
Junior Hsu (talk | contribs) |
|||
| Line 12: | Line 12: | ||
widgets: { | widgets: { | ||
"mywidget1": { | "mywidget1": { | ||
name: "MyApp2000 Widget", | "name": "MyApp2000 Widget", | ||
href: "/widget.html", | "href": "/widget.html", | ||
description: "This is my cool widget", | "description": "This is my cool widget", | ||
screenshot: "foo.jpg" | "screenshot": "foo.jpg" | ||
}, | }, | ||
"myotherwidget": { ... } | "myotherwidget": { ... } | ||
| Line 31: | Line 31: | ||
"mywidget1": { | "mywidget1": { | ||
"name":"MyApp2000 Widget", | "name":"MyApp2000 Widget", | ||
"description":"This is my cool widget" | "description":"This is my cool widget", | ||
"screenshot": "foo_en-US.jpg" | |||
}, | }, | ||
"myotherwidget": { ... } | "myotherwidget": { ... } | ||
| Line 42: | Line 43: | ||
In order to expose to privileged APPs and consider security issue. | In order to expose to privileged APPs and consider security issue. | ||
* "embed-widgets" is a new permission for " | * "embed-widgets" is a new permission for "mozwidget" attribute, it is similar to [https://developer.mozilla.org/en-US/Apps/Build/App_permissions#embed-apps 'embed-apps'] but is more restricted. Please refer to [https://wiki.mozilla.org/WebAPI/WidgetAPI#Browser_API next section]. | ||
* Set manifest entry in "widget" attribute. | * Set manifest entry in "widget" attribute. | ||
<iframe mozbrowser=“true" mozwidget="manifestURL" src=“widget.html” remote=“true”> | <iframe mozbrowser=“true" mozwidget="manifestURL" src=“widget.html” remote=“true”> | ||
| Line 52: | Line 53: | ||
==== Restriction ==== | ==== Restriction ==== | ||
* | *Limite SRC value in widgetPages list. | ||
*Disallow parts of security sensitive browser API | *Disallow parts of security sensitive browser API | ||
*Ignore mozLockOrientation/mozUnlockOrientation | *Ignore mozLockOrientation/mozUnlockOrientation | ||
| Line 60: | Line 61: | ||
*Widget: | *Widget: | ||
<iframe mozbrowser=“true" mozwidget=“manifestURL” remote=“true” src=”widgetURL”> | |||
<iframe mozbrowser=“true" | |||
*Open Bookmark: | *Open Bookmark: | ||
//browser (full-set) | //browser (full-set) | ||
<iframe mozbrowser=“true" remote="true" src="http://example.com"> | <iframe mozbrowser=“true" remote="true" src="http://example.com"> | ||
=== Pages DON'T Want to Be Shown in Widgets === | |||
==== Packaged App ==== | |||
An app can use "widgetPages" to list the white list of widget pages. All pages in this list can be accessed through widget iframe. Others are shown as blank page. | |||
*If a widget navigates to pages which are not listed in widgetPages, the widget iframe shows blank on it. | |||
*If a widget navigates to another domain, the widget iframe cannot use any APIs which requires permissions. | |||
==== Web Pages ==== | |||
A web page can declare itself to not be embedded in widget iframe by "X-Frame-Options", like normal web page. For more options of X-Frame-Options can be found at: https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options | |||
=== Localization of Widget Info === | |||
Similar to app's localization, the localization of widget info MUST be embedded in "widgets" of "locales" properties. And they are referenced to each other with widget id, like mywidget1 or myotherwidget. | |||
==Issues under discussion== | ==Issues under discussion== | ||