According to https://w3c.github.io/ServiceWorker/#control-and-use-worker-client, workers should inherit controllers for the blob URL. However, existing code allows only dedicated workers to inherit the controller, and shared workers do not inherit the controller. This is the fix to make Chromium behavior adjust to the specification.
This is a change to make the Chromium behavior aligned with the specification, there should not be an interoperability issue. However, there is a compatibility issue from the past Chromium. If a blob URL is used for a SharedWorker script and a controller for the URL is mattered, there is a behavior change because this change makes a controller inherited.
n/a
Since this is adjusting Chromium behavior to specification, there should not be a security risk from a specification perspective. From the implementation perspective, this change simply inherits existing controller. There should not be any additional security risks with this change.
Does this intent deprecate or change behavior of existing APIs, such that it has potentially high risk for Android WebView-based applications?
None
n/a
Since SharedWorker is not supported in Android yet, the feature also does not affect to Android.
https://wpt.fyi/results/service-workers/service-worker/local-url-inherit-controller.https.html Same-origin blob URL sharedworker should inherit service worker controller. Same-origin blob URL sharedworker should intercept fetch(). The tests ensure a ServiceWorkerController is inherited. Due to crbug.com/40364838, Chromium does not pass the former test.
Shipping on desktop | 124 |
Open questions about a feature may be a source of future web compat or interop issues. Please list open issues (e.g. links to known github issues in the project for the feature specification) whose resolution may introduce web compat/interop risk (e.g., changing to naming or structure of the API in a non-backward-compatible way).
NoneContact emails
yyana...@google.comSpecification
https://w3c.github.io/ServiceWorker/#control-and-use-worker-clientSummary
According to https://w3c.github.io/ServiceWorker/#control-and-use-worker-client, workers should inherit controllers for the blob URL. However, existing code allows only dedicated workers to inherit the controller, and shared workers do not inherit the controller. This is the fix to make Chromium behavior adjust to the specification.
Blink component
Blink>WorkersTAG review
NoneTAG review status
Not applicableRisks
Interoperability and Compatibility
This is a change to make the Chromium behavior aligned with the specification, there should not be an interoperability issue. However, there is a compatibility issue from the past Chromium. If a blob URL is used for a SharedWorker script and a controller for the URL is mattered, there is a behavior change because this change makes a controller inherited.
--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAPNB-6XQqR4S-wtpBkMT6CSADHGV2nvw2irn3jwd5CyZHcMftw%40mail.gmail.com.
On Tue, Mar 5, 2024 at 5:01 AM Yoshisato Yanagisawa <yyana...@chromium.org> wrote:Contact emails
yyana...@google.comSpecification
https://w3c.github.io/ServiceWorker/#control-and-use-worker-clientSummary
According to https://w3c.github.io/ServiceWorker/#control-and-use-worker-client, workers should inherit controllers for the blob URL. However, existing code allows only dedicated workers to inherit the controller, and shared workers do not inherit the controller. This is the fix to make Chromium behavior adjust to the specification.
Blink component
Blink>WorkersTAG review
NoneTAG review status
Not applicableRisks
Interoperability and Compatibility
This is a change to make the Chromium behavior aligned with the specification, there should not be an interoperability issue. However, there is a compatibility issue from the past Chromium. If a blob URL is used for a SharedWorker script and a controller for the URL is mattered, there is a behavior change because this change makes a controller inherited.
I think it makes sense to send an intent to ship for this, based on the specified criteria.That would enable us to evaluate the compatibility risk, and make sure we're making the right call here.