Re: [ServiceWorker] Can we replace event.default() with something less magic? (#607)

My vague solution was to have a Document check CSP both on the outgoing request (before SW intercepts), and on the incoming response (after SW manipulation). To do so, we'd need to know the final URL (or at least the final origin) in order to ensure that the Document-level CSP can actually lock `script-src` down to a certain set of origins.

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/607#issuecomment-74675768