Re: [w3c/ServiceWorker] `<iframe sandbox />` + SW (#1390)

We have no precedent for a cross origin service worker.  That would complicate a lot of security checks in implementations.  I personally would be opposed to doing that.  I guess we've never explicitly discussed that situation before.

Also, the embedder is still in control.  They can simply not use the sandbox attribute.  By using sandbox without allow-same-origin they are saying they don't trust the content of what they are going to be loading in that context and I don't think we should give it access to the service worker.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/1390#issuecomment-465618066