Re: [ServiceWorker] openWindow(url)'s same origin check should be done against the origin of the final response's url? (#646)

FWIW, the way the blink impl worked was: when the newly opening window hit some step in the load process the SW backend was notified. At that arbitrary point, if the window was a controlled client, the promise is fulfilled with a client instance. Otherwise, the promise is fulfilled with null. That logic handled a redirect to another origin and/or out-of-scope, and IMHO was at least sane in the timer case (as in: similar to acquiring a client object, which is invalidated shortly thereafter by a timed navigation)

At the very least, that needs to be modified now that we have the notion of non-controlled clients.

Aside: should there be a 'controlled' bit on Client objects?






---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/646#issuecomment-77890200