Re: [ServiceWorker] Should window.caches be removed (or readonly) for security reasons? (#698)

Is this only an issue for non-trusted (http://) resources?

It seems if a SW stores an https:// resource and which is then overwritten with a polluted Response, then the polluted Response would be missing the security info for the origin.  I would expect the browser to give a mixed-content warning or something similar when this response is passed to respondWith().

I guess the spec does not define how to trust or not-trust synthetically created responses, though.

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/698#issuecomment-106497930