Re: [w3c/ServiceWorker] Add new environment settings object field "cross site ancestry" for SameSite cookies work (PR #1775)

@yoshisatoyanagisawa commented on this pull request.



> @@ -3065,6 +3065,8 @@ spec: storage; urlPrefix: https://storage.spec.whatwg.org/
               :: Return |serviceWorker|'s [=service worker/script url=].
               : The [=environment settings object/origin=]
               :: Return its registering [=/service worker client=]'s [=environment settings object/origin=].
+              : The [=environment settings object/cross site ancestry=]
+              :: Return its registering [=/service worker client=]'s [=environment settings object/cross site ancestry=].

Thank you for the detailed response.

My understanding is that [set up a worker environment settings object](https://html.spec.whatwg.org/multipage/workers.html#set-up-a-worker-environment-settings-object) applies to DedicatedWorkers and SharedWorkers, but not to ServiceWorkers, which follow their own setup process.

This seems to be the source of my concern.  Because the Service Worker's environment is based on the **registering client**, and its setup process does not seem to inherit the ancestry from the currently controlled client (the iframe), I believe the Fetch event's `client` argument will end up with an ESO where `cross-site ancestry` is incorrectly `false`.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/pull/1775#discussion_r2127942346
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/ServiceWorker/pull/1775/review/2898857831@github.com>