Re: [ServiceWorker] Can we replace event.default() with something less magic? (#607)

> My vague solution was to have a Document check CSP both on the outgoing request (before SW intercepts), and on the incoming response (after SW manipulation). To do so, we'd need to know the final URL (or at least the final origin) in order to ensure that the Document-level CSP can actually lock script-src down to a certain set of origins.

Does this mean the SW script must set a URL with the correct origin when synthetically creating Response objects to return?

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/607#issuecomment-74678969