Re: [whatwg/fetch] Adds "audioworklet" and "paintworklet" as destinations. (#527)

Actually, step 3 here:

https://drafts.css-houdini.org/worklets/#script-settings-for-worklets

Says worklets should be a unique opaque origin.  If this is the case then they are like a data: URL dedicated worker.

According to the service worker spec data: URL dedicated workers should be uncontrolled.  Their subresource requests like importScripts() should not be intercepted.

It did some quick testing and chrome follows this today.  If you load a data: URL worker from a controlled page any fetch()/importScripts() within that worker are not intercepted.

Firefox does intercept the data: URL worker's subresource requests, but I'm in the process of fixing that.

How does this apply to worklets?

Based on the current spec my view is the worklet global should be a Client with an opaque origin.

I think we could argue, however, that the Client invoking the worklet script Fetch is the Client that calls `addModule()`.  This code is not run from within the worklet (AFAICT).  Its unclear to me what the Client of the Fetch request is looking at the current worklet spec.

@annevk, what do you think?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/527#issuecomment-335861699