Re: [w3c/ServiceWorker] Is there a security issue justifying no `Set-Cookie` setting in SW? (Issue #1649)

Maybe part of the challenge is that a service worker can not only intercept requests to its own origin, but also subresource requests to any other origin. While the `CookieStore` API lets the service worker modify its own cookies, setting `Set-Cookie` headers on `Response` objects could be problematic for responses to cross-origin requests (or those would at least have to be treated differently from same origin requests).

Also semantics might be weird; service workers can reply to requests with responses containing Set-Cookie headers already (just not synthetic responses). It's just that today Set-Cookie headers are only parsed when the response comes from the network, and not even when for example a response is loaded from the network cache.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/1649#issuecomment-1176745488
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/ServiceWorker/issues/1649/1176745488@github.com>