Re: [ServiceWorker] Should an IFRAME without src be controlled by SW when its parent is controlled? (#612)

Agree with @annevk that we should follow CSP here, which means using the document's controller if the iframe is `blob`, `data` etc https://w3c.github.io/webappsec/specs/content-security-policy/#globally-unique-identifier.

Does "globally unique identifier" include `about:` @mikewest?

@kinu sorry if this is a pain.

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/612#issuecomment-72405718