Re: [w3c/ServiceWorker] consider allowing static routing only for "foreign fetch" for anonymous requests (#1024)

I think we've mainly be considering static routes as an optimization in the past.  The fact it avoids js, however, makes it also a nice way to restrict arbitrary code execution in dangerous situations.  This could be more of a driver to implement it (for me anyway).

For example, another possible use here would be a CSP directive indicating static routing is allowed, but service worker js should never be executed.  This would allow a site to utilize some of our main use cases while locking down the risk of losing control of their site via some XSS service worker exploit.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/1024#issuecomment-266757202