Re: [whatwg/fetch] Hide range values from no-cors cross-origin range requests (Issue #1936)

edenchuang left a comment (whatwg/fetch#1936)

@yoshisatoyanagisawa 

https://github.com/w3c/ServiceWorker/issues/719
https://docs.google.com/document/d/1fOjXiGUFf_krkfYaWf5drbqzY7CTxn7EcDYr5ZWjzFg/edit?tab=t.0#heading=h.4ytttsqbie9c
Maybe another case of "Bypassing the Service Worker for XS-Leak prevention on same-origin/cross-origin requests"

But I agree that this would confuse web developers. Option 1 would be more aggressive because it also skips the SW for the same-origin request. We probably need a place, maybe the ServiceWorker Spec, to inform ServiceWorker developers which requests will not be intercepted. 


-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1936#issuecomment-4830323810
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1936/4830323810@github.com>