Re: [ServiceWorker] Should window.caches be removed (or readonly) for security reasons? (#698)

Is there any difference between `trusted-only` and `caches.match(url).then(r => r.url == url ? r : null)`?

> What are the use cases that are only possible with window.caches?

Take https://wiki-offline.jakearchibald.com/ - when articles are cached the page handles it (via `window.caches`. When cached articles are displayed the page fetches them from a cache. The list of cached articles is all page-side too.

Sure, you can pass messages to & from the SW to do this stuff, but it's really hacky (see https://github.com/jakearchibald/trained-to-thrill/blob/master/src/js/sw/index.js#L71).

Browser storage is accessible in both pages and workers. We need a really good reason to make an exception here, and I don't think we have one.

If you make the cache API more difficult to use, developers will move to another storage system such as idb, which can be accessed between page & worker. Eg, the original cache polyfill was idb based.

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/698#issuecomment-105028595