@yongsheng I talked with @kenchris about this. The option "1. Introduce a white list" is preferred. This feature is something we will not add to the Manifest spec at this time (because it would break the security model of the browsers), so consider this a Crosswalk-specific extension to the Manifest spec.

Please use "xwalk_hosts" as the name of the Manifest member to align with Chrome Apps' Manifest v3 (https://docs.google.com/document/d/1dgkxhdKvGQD2DeJ_3NLLBAb6OZ0F_u9F6J4qL2UGX7M/) and to obey the Manifest spec extension conventions (http://manifest.sysapps.org/#proprietary-extensions).