Re: [w3c/ServiceWorker] Add Register a Service Worker algorithm for use by other specifications (PR #1848)

@yoshisatoyanagisawa commented on this pull request.



> +  <section algorithm>
+    <h3 id="register-a-service-worker-algorithm"><dfn export>Register a Service Worker</dfn></h3>
+
+    Note: Because this algorithm has no calling [=/service worker client=], the [=job/referrer=] is not set by [=Create Job=]. To satisfy the same-origin checks in the [=Register=] algorithm (steps 2 and 3), this algorithm explicitly sets the job's [=job/referrer=] to |scriptURL|. Combined with the same-origin precondition asserted in step 1, this ensures both same-origin checks in [=Register=] pass.
+
+      : Input
+      :: |storageKey|, a [=/storage key=]
+      :: |scriptURL|, a [=/URL=]
+      :: |scopeURL|, a [=/URL=]
+      :: |workerType|, a [=job/worker type=]
+      :: |updateViaCache|, a [=service worker registration/update via cache mode=]
+      : Output
+      :: None
+
+      1. Assert: |scriptURL|'s [=url/origin=] and |scopeURL|'s [=url/origin=] are [=same origin=].
+      1. If the result of running <a>potentially trustworthy origin</a> with |scriptURL|'s [=url/origin=] as the argument is <code>Not Trusted</code>, return.

I assume that `Start Register` (https://w3c.github.io/ServiceWorker/#start-register) does more validation inside.  However, such validation looks not implemented here.  For example, a scheme is limited to HTTP/HTTPS, a hash will be omitted, etc.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/pull/1848#pullrequestreview-5128886254
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/ServiceWorker/pull/1848/review/5128886254@github.com>