Re: [ServiceWorker] openWindow(url)'s same origin check should be done against the origin of the final response's url? (#646)

> At the very least, that needs to be modified now that we have the notion of non-controlled clients.

Right. A `Client` object can capture any service worker client in the same-origin to the service worker. E.g. a `message` event posted by `registration.installing.postMessage` holds a non-controlled `Client` object in `e.source`.

> Aside: should there be a 'controlled' bit on Client objects?

Although we have a way to filter out non-controlled clients (`clients.matchAll`) already (that's the default behavior), adding `Client.activeWorker` can allow authors to check whether the retrieved clients are controlled or not and also which service worker those clients are controlled by. 

Not sure the use cases that need grasping uncontrolled clients are compelling tho.

cc/ @jakearchibald @slightlyoff 

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/646#issuecomment-77999708