Re: [w3c/ServiceWorker] consider fetching service worker scripts with no-cache by default (#893)

@JustinDrake Your use-case has been raised in some other issues as well.  The short story is that the use-case is at odds with the intent of ServiceWorkers and the web security model.  If you can create a benevolent SW that can never be removed so it can survive when the server is compromised, then an attacker can construct a nefarious SW that can never be removed the one time the server is compromised.  And browsers can't distinguish between benevolent and nefarious, just whether the TLS cert is valid.

I think many of us are interested in this specific use-case, but SW is not going to be the solution for that on its own.  The most practical solution at this time is to use the increasingly cross-browser WebExtensions efforts that are already built on a packaged/release model and APIs like [webRequest](https://developer.mozilla.org/en-US/Add-ons/WebExtensions/API/webRequest) that lets you intercept requests to specific sites and validate/enforce their contents, etc.  It's also possible spec efforts like https://w3ctag.github.io/packaging-on-the-web/ may bear fruit at some point.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/893#issuecomment-277347045