Re: [w3c/ServiceWorker] clients.get() should not resolve before sandboxing determines the origin of the client (#1385)

So, AIUI your test creates an iframe with a URL and the resulting load sets sandboxing via a CSP header.

I think resultingClientId probably *should* resolve before the CSP header is applied.  Currently its supposed to resolve with the initial about:blank.  If the final document is same-origin, then the client is preserved.  If it ends up cross-origin due to navigation or header-applied sandboxing, then that initial about:blank client is discarded and a new one created.  But before the document is loaded and headers applied, though, the initial about:blank client is execution ready.

So I think this is why firefox is failing your test.  Its marking the initial about:blank execution ready which causes it to resolve the client.

Since chrome does not expose initial about:blank in the clients API yet, I think we could perhaps disambiguate the test to avoid the situation.  A couple ideas:

1. Set sandboxing via an iframe attribute instead of a header.
2. Make the SW script stash the resultingClientId and only do the clients.get() after the iframe has loaded.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/1385#issuecomment-457216514