Re: [slightlyoff/ServiceWorker] clarify secure context requirements in Handle Fetch (#890)

It doesn't even make sense for "target client". The way things like window.open are specified for example the "noopener" flag isn't applied until after fetch has completed. And that noopener flag can be the difference between the target client being a secure context or not.

But this is kind of the same issue I was trying to figure out for Link headers (how to specify that Link: rel=serviceworker headers should only be processed for top-level requests that will result in a secure context). I somehow didn't realize that we already have this problem with Handle Fetch. I don't think there is a way with the way the fetch, html and secure contexts spec are currently written to properly specify this. But it certainly seems likely a request will need access to both the client that initiated a request and the client that could possibly be created using the result of the request.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/890#issuecomment-215287350