Re: [w3c/ServiceWorker] Match Service Worker Registration should assert same-origin? (#1118)

Sorry. Re-opened.

I thought [URL parser](https://url.spec.whatwg.org/#concept-url-parser) and [URL serializer](https://url.spec.whatwg.org/#concept-url-serializer) guarantee the same origin requirement for the matching URL strings. We explicitly invoke URL serializer when storing a new registration, and later compare them to serialzed URLs. I'd like to hear @annevk's comment on it.

Meantime, I just checked out the implementations. Both Chrome and Firefox get the list of the registrations for the origin first and match the longest possible URL from that list. Not sure if it was to reflect the security requirement or performance requirement, or both. That considered, I'm happy to align the algorithm to the implementations. If I change this, I plan to change the type of the scope url of the [scope to registration map](https://w3c.github.io/ServiceWorker/#dfn-scope-to-registration-map) from a string to a URL record and adjust the references accordingly.

/cc @mattto @wanderview @aliams 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/1118#issuecomment-300706335