Re: [w3c/ServiceWorker] Match Service Worker Registration should assert same-origin? (#1118)

Emily and I still think it's necessary to perform a simple check that the origins (not the URLs) are equal. Origin equality is well-defined: are the schemes equal (case-insensitive string comparison), are the hostnames equal (case-insensitive string comparison), and are the ports equal (int16_t equality).

Origin-matching is a crucial security guarantee on the web, and so we don't feel entirely comfortable without a clear statement (in the spec and in the implementation) that an origin equality check is required.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/1118#issuecomment-300579897