Re: [w3c/IndexedDB] Security and Web Worker access for IndexedDB (#141)

Agreed, making IndexedDB a policy-controlled feature would restrict it in cross-origin content by default, and allow the embedder to selectively allow it per-frame or per-origin as needed.

For workers, the situation should be the same -- but since they're always same-origin, what you should be able to do is *disable* the API in the worker as needed. I haven't completely specced the way that policies should apply to workers, but dedicated workers should be analogous to framed content.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/IndexedDB/issues/141#issuecomment-324664164