Address privacy issue with start_url (#1029)

w3c · Jan 24, 2022 · 5d2ac4b · 5d2ac4b
1 parent f8d326b
commit 5d2ac4b
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/index.html b/index.html
@@ -818,6 +818,11 @@ <h3>
             time thereafter, a user agent allows the user to inspect and, if
             necessary, modify the <a>start URL</a> of an application.
           </p>
+          <p>
+            Additionally, developers MUST NOT use the <a>start URL</a> to
+            include information that uniquely identifies a user (e.g.,
+            "?user=123" or "/user/123/", or "https://user123.foo.bar").
+          </p>
         </section>
       </section>
       <section>