Re: [ServiceWorker] Should window.caches be removed (or readonly) for security reasons? (#698)

> I think you mean check the content when retrieved from localStorage. And you could do the same thing with Cache API in your service worker script.

True, it should be possible to check the response and request url for equality.

> For example, a cache.match(url, { trusted-only: true }) option. When set this would require that the security info (cert) associated with the Response must match the request URL and be computed as trusted.

Sounds, like a good addition. It would make opting into a more secure model easier.
Still, secure by default is better than secure via opt-in.

What are the use cases that are only possible with `window.caches`?


---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/698#issuecomment-104932344