[PWA URL Handling] Sites should be able to allow open PWA access

[mhochk]

The current spec'd pwa-site-association file doesn't allow for a site owner to openly allow any PWA to handle it's URIs (or a subset of them). I think to remedy this, wildcard support should be added to the 'manifest' field of this pwa-site-association.

Though I don't think this would be common for most sites, I can imagine some testing and education scenarios, as well as some open-source communities that may want to open this ability to everyone.

[HowardWolosky]

@mhochk, can you provide a strong example here? This sounds pretty dangerous to me. With one mistaken configuration property added to a manifest for a banking site, all of a sudden any PWA would be able to register as its URL handler and potentially spoof the site.

[LuHuangMSFT]

Closing here. Please continue the discussion here: WICG/pwa-url-handler#3