Cross-origin Service Workers

RESOLVED WONTFIX

Status

()

P5
normal
RESOLVED WONTFIX
3 years ago
6 months ago

People

(Reporter: benfrancis, Unassigned)

Tracking

({feature})

Firefox Tracking Flags

(Not tracked)

Details

User Story

As a developer I'd like to register a Service Worker which can respond to XHR/fetch requests made from other origins to my origin.
(Reporter)

Description

3 years ago
As a developer I'd like to register a Service Worker which can respond to XHR/fetch requests made from other origins to my origin.

We have many potential use cases for this in Gaia for creating REST style web services which can work even while offline, potentially replacing many of the proprietary APIs we currently use in B2G.

Something along these lines is being discussed for the Service Worker specification https://github.com/slightlyoff/ServiceWorker/issues/684 and previously in relation to navigator.connect https://github.com/mkruisselbrink/navigator-connect/issues/23

See also: dev-webapi thread https://groups.google.com/forum/#!msg/mozilla.dev.webapi/2NWlXa9SlqY/mQ0zBI1SChUJ
When speccing this out we should make sure we do not cause a problem similar to CSRF, where a hostile website can coerce a Cross-Origin ServiceWorker to do something the user did not intend it to do. I'm happy to provide some feedback along the process.

Updated

6 months ago
Status: NEW → RESOLVED
Last Resolved: 6 months ago
Priority: -- → P5
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.