Re: [ServiceWorker] Should window.caches be removed (or readonly) for security reasons? (#698)

> Is there any difference between trusted-only and caches.match(url).then(r => r.url == url ? r : null)?

The existence of a trusted certificate that matches that URL on the response?  I don't see how your `== url` in js is really equivalent.

That being said, I think there would be more details to figure out for something like `trusted-only`.  For example, do synthetically created responses get security info associated with them?  In gecko, we give them the service worker scripts security info in order to mixed content problems.  I don't think this is spec'd, though.

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/698#issuecomment-105237623