Web-Facing Change PSA: SharedWorker script inherit controller for blob script URL

123 views
Skip to first unread message

Yoshisato Yanagisawa

unread,
Mar 4, 2024, 11:01:21 PMMar 4
to blink-dev

Contact emails

yyana...@google.com

Specification

https://w3c.github.io/ServiceWorker/#control-and-use-worker-client

Summary

According to https://w3c.github.io/ServiceWorker/#control-and-use-worker-client, workers should inherit controllers for the blob URL. However, existing code allows only dedicated workers to inherit the controller, and shared workers do not inherit the controller. This is the fix to make Chromium behavior adjust to the specification.



Blink component

Blink>Workers

TAG review

None

TAG review status

Not applicable

Risks



Interoperability and Compatibility

This is a change to make the Chromium behavior aligned with the specification, there should not be an interoperability issue. However, there is a compatibility issue from the past Chromium. If a blob URL is used for a SharedWorker script and a controller for the URL is mattered, there is a behavior change because this change makes a controller inherited.



Gecko: No signal

WebKit: Shipped/Shipping

Web developers: No signals

Other signals:

Ergonomics

n/a



Security

Since this is adjusting Chromium behavior to specification, there should not be a security risk from a specification perspective. From the implementation perspective, this change simply inherits existing controller. There should not be any additional security risks with this change.



WebView application risks

Does this intent deprecate or change behavior of existing APIs, such that it has potentially high risk for Android WebView-based applications?

None



Debuggability

n/a



Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, ChromeOS, Android, and Android WebView)?

No

Since SharedWorker is not supported in Android yet, the feature also does not affect to Android.



Is this feature fully tested by web-platform-tests?

Yes

https://wpt.fyi/results/service-workers/service-worker/local-url-inherit-controller.https.html Same-origin blob URL sharedworker should inherit service worker controller. Same-origin blob URL sharedworker should intercept fetch(). The tests ensure a ServiceWorkerController is inherited. Due to crbug.com/40364838, Chromium does not pass the former test.



Flag name on chrome://flags

n/a

Finch feature name

SharedWorkerBlobURLFix

Requires code in //chrome?

False

Tracking bug

https://issues.chromium.org/issues/324939068

Estimated milestones

Shipping on desktop124


Anticipated spec changes

Open questions about a feature may be a source of future web compat or interop issues. Please list open issues (e.g. links to known github issues in the project for the feature specification) whose resolution may introduce web compat/interop risk (e.g., changing to naming or structure of the API in a non-backward-compatible way).

None

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/6401033384493056

This intent message was generated by Chrome Platform Status.

Yoav Weiss (@Shopify)

unread,
Mar 6, 2024, 5:21:06 AMMar 6
to Yoshisato Yanagisawa, blink-dev
On Tue, Mar 5, 2024 at 5:01 AM Yoshisato Yanagisawa <yyana...@chromium.org> wrote:

Contact emails

yyana...@google.com

Specification

https://w3c.github.io/ServiceWorker/#control-and-use-worker-client

Summary

According to https://w3c.github.io/ServiceWorker/#control-and-use-worker-client, workers should inherit controllers for the blob URL. However, existing code allows only dedicated workers to inherit the controller, and shared workers do not inherit the controller. This is the fix to make Chromium behavior adjust to the specification.



Blink component

Blink>Workers

TAG review

None

TAG review status

Not applicable

Risks



Interoperability and Compatibility

This is a change to make the Chromium behavior aligned with the specification, there should not be an interoperability issue. However, there is a compatibility issue from the past Chromium. If a blob URL is used for a SharedWorker script and a controller for the URL is mattered, there is a behavior change because this change makes a controller inherited.


I think it makes sense to send an intent to ship for this, based on the specified criteria.
That would enable us to evaluate the compatibility risk, and make sure we're making the right call here.

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAPNB-6XQqR4S-wtpBkMT6CSADHGV2nvw2irn3jwd5CyZHcMftw%40mail.gmail.com.

Yoshisato Yanagisawa

unread,
Mar 6, 2024, 9:03:40 PMMar 6
to Yoav Weiss (@Shopify), blink-dev


2024年3月6日(水) 19:21 Yoav Weiss (@Shopify) <yoav...@chromium.org>:


On Tue, Mar 5, 2024 at 5:01 AM Yoshisato Yanagisawa <yyana...@chromium.org> wrote:

Contact emails

yyana...@google.com

Specification

https://w3c.github.io/ServiceWorker/#control-and-use-worker-client

Summary

According to https://w3c.github.io/ServiceWorker/#control-and-use-worker-client, workers should inherit controllers for the blob URL. However, existing code allows only dedicated workers to inherit the controller, and shared workers do not inherit the controller. This is the fix to make Chromium behavior adjust to the specification.



Blink component

Blink>Workers

TAG review

None

TAG review status

Not applicable

Risks



Interoperability and Compatibility

This is a change to make the Chromium behavior aligned with the specification, there should not be an interoperability issue. However, there is a compatibility issue from the past Chromium. If a blob URL is used for a SharedWorker script and a controller for the URL is mattered, there is a behavior change because this change makes a controller inherited.


I think it makes sense to send an intent to ship for this, based on the specified criteria.
That would enable us to evaluate the compatibility risk, and make sure we're making the right call here.

Thanks for the comment.  Considering the ratio the blob URL is used for SharedWorker script, I can hardly say the blob URL users are negligibly small.
Since Chromium's WorkerNavigator for SharedWorker does not implement serviceWorker yet (https://issues.chromium.org/issues/40364838), people may not write code that heavily depends on this.
However, the controller can also be visible in the ServiceWorker FetchEvent as client IDs, and I am not sure the number of users depending on that there.
Let me withdraw this PSA just in case.
Reply all
Reply to author
Forward
0 new messages