[w3c/ServiceWorker] Should referer header be included in fetchEvent request object? (Issue #1723)

Are there any reason why referer is not included wit fetchEvent in the Service Worker?

I have this use case where I wanted to block all requests that originated from specific page.

This is actual code that used my library called Wayne, that I was hoping it would work:

```javascript
importScripts('https://cdn.jsdelivr.net/npm/@jcubic/wayne@0.17.0/index.umd.min.js');

const app = new wayne.Wayne();

app.get('https://*/*', (req, res) => {
    const referer = req.headers.get("Referer");
    const url = new URL(referer);
    if (url.host === 'localhost' && url.pathname == '/') {
        res.fetch(req);
    } else {
        res.json({error: 'Forbidden'}, { status: 403 });
    }
});
```

I should block every request that was not sent from the home page of localhost. But unfortunately, Referer is not included, so something like this is not possible. At least in Chrome and Firefox.

I was looking at the [spec](https://www.w3.org/TR/service-workers) and was not able to find a list of headers or referer.

Was this written somewhere that it should not be allowed to read the referer?



-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/1723
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/ServiceWorker/issues/1723@github.com>