- From: Anne van Kesteren <annevk@annevk.nl>
- Date: Mon, 20 Jul 2015 14:45:51 +0200
- To: Mike West <mkwst@google.com>
- Cc: Brian Smith <brian@briansmith.org>, Brad Hill <hillbrad@gmail.com>, Wendy Seltzer <wseltzer@w3.org>, Dan Veditz <dveditz@mozilla.com>, Kristijan Burnik <burnik@google.com>, "public-webappsec@w3.org" <public-webappsec@w3.org>, Alex Russell <slightlyoff@google.com>, Ryan Sleevi <sleevi@google.com>
On Mon, Jul 20, 2015 at 2:35 PM, Mike West <mkwst@google.com> wrote: > I'll poke at MIX this afternoon to bake in the passthrough loophole > discussed here. It's not entirely clear to me how to distinguish a `fetch()` > issued from the Document from the `fetch(event.request)` issued from the > Service Worker (as they'll both have a `context` of "fetch", right? and both > point to the same `window`?). Perhaps it makes sense to divide the "fetch" > context into "fetch" and "passthrough-fetch" in the same way we divided > "image" and "image-set"? Why do you need to distinguish them? It seems to me you only need to disallow mixed content when request's window is "no-window", which would apply to both documents and workers. -- https://annevankesteren.nl/
Received on Monday, 20 July 2015 12:46:17 UTC