Re: [MIX] Consider all CORS requests "active"

On 10 July 2014 18:35, Brian Smith <brian@briansmith.org> wrote:

> On Thu, Jul 10, 2014 at 4:08 AM, Jake Archibald <jaffathecake@gmail.com>
> wrote:
> > In ServiceWorker, this means:
> >
> > importScripts('http://...'); - fails
> > fetch('http://...'); - fails
> > cache.add('http://...'); - fails
> >
> > …as they're all CORS dependant.
>
> Anything mixed-content with ServiceWorker should always fail, because
> ServiceWorker would fall under the rule "mixed content is forbidden
> from anything new we add to the web platform." This would include, in
> particular, even <img> requests handled by a ServiceWorker.
>

One of the problems with Appcache is you had to rearchitect your site
around it, ServiceWorker mustn't be like that.

this.onfetch = function(event) {
  // do nothing
};

this.onfetch = function(event) {
  event.respondWith(event.default());
};

this.onfetch = function(event) {
  event.respondWith(fetch(event.request));
};

…none of the above should cause images to fail in cases where they wouldn't
without a serviceworker. The <img> should decide whether it should accept
or deny the response, not the serviceworker. If the HTTP image request
requires cors (<img crossorigin>) it should fail in all 3 cases. If it
doesn't require cors, it should create a mixed content warning in all 3
cases.

Mixed content will be opaque (like all responses to no-cors requests), it's
down to the eventual consumer (<img>, <script>, @font-face etc) whether to
block or allow.