Re: [w3c/ServiceWorker] should blob URLs inherit controller from parent environment or environment that called `createObjectURL()`? (#1261)

> Well, the spec was changed without any implementations following. So I think its more the spec that's out on a limb here.

I don't think the spec ever said anything else? At least every version of module workers I remember reading about in the spec allowed cross-origin URLs... Anyway, that doesn't really matter.

> Anyway, the iframe case shows the problem more clearly.

Yeah, agreed. It still feels weird to me to inherit the controller from whoever created the blob URL, but if we want to let cross origin blob URLs be controlled we don't have a choice. I'm not convinced that we do want those to be controlled as it sort of feels like a weird thing where doing something in one place triggers something far away (i.e. that one document happens to load a blob URL in a worker suddenly triggers events in another origins service worker). It's probably harmless, and it sort of makes sense (and somebody creating blob URLs should already realize/be careful that loading that content will end up running in its own origin), but it feels like it might be unexpected... 

Also inheriting controller from parent is nice and self-contained while inheriting controller from blob URL creator would require reaching out into other specs. But that is pretty minor of course.

So in summary, I like the simplicity of inheriting controller from the parent as long as the new client is in fact same origin, and otherwise just not having a controller, but I could be convinced that inheriting the controller from the blob URL's environment is the right thing.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/1261#issuecomment-358799899