Re: [w3c/ServiceWorker] Match Service Worker Registration should assert same-origin? (#1118)

I believe the URL string comparison is only safe because http/https URLs serialize with a trailing slash. If it weren't for the trailing slash, one URL could be a prefix-match for another non-same-origin URL.

Relying on the trailing slash serialization seems extremely fragile and non-obvious to me, which is why I suggested adding an assertion that the matched URL is same-origin.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/1118#issuecomment-300864187