Re: [w3c/ServiceWorker] support efficient offline redirects (#1457)

> I think our position was that for users who have a particular workflow they would like visit the vanity url if they use it and get it cached. Not great, but its an improvement over the current behavior.
This makes sense as a best effort solution. Though this makes it hard for us to promote that vanity url, as it can be unreliable since it's dependent on usage patterns (eg: user uses it all the time on their desktop, and then decides to use it for the first time offline on their laptop).

> Also, note the cross-origin issues I note above also make it impossible to register a service worker on cross-origin vanity urls. You can't register the service worker if the url is always redirecting and double-keying in browsers prevents using an iframe to the origin to register the service worker.
It seems to me that there is a general issue here, that installing service workers on third party sites is simply impossible in browsers that do double-keying. This is not just needed for vanity urls, but also for sites that own multiple domains that are interconnected (eg: you enable a feature, which should cause a service worker to be registered on two domains). We do this today on Chrome, by registering service workers via iframes.

> What we talked about at TPAC face-to-face was using the heuristic that if max-age is 1 year or more then the redirect would be permanent. As in we would not age it out even after a year.
Doesn't this introduce a security issue? Let's say site A, wants to serve a permanent redirect with a lifetime of 1 year to site B. Site B registers a service worker, and effectively hijacks the redirect forever. Site A, may be owned by a separate entity from site B, and may want to lease their domain name this way. Storing a resource for less time than suggested is fine obviously (eg: cache eviction), but it seems to me that we should never exceed max-age dictated by the source server.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/1457#issuecomment-538298141