[w3c/ServiceWorker] Service workers allow for more responses to be executed as script (#1509)

Before service workers you could only execute as script what `<script src>` allows you to target. After service workers any response a service worker can obtain, can be given to a `<script>`. E.g., consider a response to a request whose method is `POST` or one that has a custom `Accept` header value.

Should we enshrine this as another weakening of the same-origin policy or do something about it?

Credit: 1lastBr3ath.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/1509