{"action":"created","issue":{"url":"https://api.github.com/repos/slightlyoff/ServiceWorker/issues/687","labels_url":"https://api.github.com/repos/slightlyoff/ServiceWorker/issues/687/labels{/name}","comments_url":"https://api.github.com/repos/slightlyoff/ServiceWorker/issues/687/comments","events_url":"https://api.github.com/repos/slightlyoff/ServiceWorker/issues/687/events","html_url":"https://github.com/slightlyoff/ServiceWorker/issues/687","id":70784121,"number":687,"title":"self.caches should spec what to do for \"untrusted\" origins","user":{"login":"wanderview","id":1256526,"avatar_url":"https://avatars.githubusercontent.com/u/1256526?v=3","gravatar_id":"","url":"https://api.github.com/users/wanderview","html_url":"https://github.com/wanderview","followers_url":"https://api.github.com/users/wanderview/followers","following_url":"https://api.github.com/users/wanderview/following{/other_user}","gists_url":"https://api.github.com/users/wanderview/gists{/gist_id}","starred_url":"https://api.github.com/users/wanderview/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wanderview/subscriptions","organizations_url":"https://api.github.com/users/wanderview/orgs","repos_url":"https://api.github.com/users/wanderview/repos","events_url":"https://api.github.com/users/wanderview/events{/privacy}","received_events_url":"https://api.github.com/users/wanderview/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-04-24T20:20:35Z","updated_at":"2015-04-24T20:28:10Z","closed_at":null,"body":"Currently `self.caches` is spec'd to always return a CacheStorage object.  Clearly, there are cases where this should not be done.  For example, in a context with a synthetic origin such as a sandboxed iframe or data URI worker.  The spec does not say what to do in these cases.\r\n\r\nThe web-platform-tests from blink show that the blink implementation throws SecurityError in this case.  That seems reasonable.\r\n\r\nI believe @ehsan would prefer we just hide the `self.caches` property in these cases.\r\n\r\nThoughts?\r\n\r\n@jakearchibald @slightlyoff @jungkees @annevk "},"comment":{"url":"https://api.github.com/repos/slightlyoff/ServiceWorker/issues/comments/96055203","html_url":"https://github.com/slightlyoff/ServiceWorker/issues/687#issuecomment-96055203","issue_url":"https://api.github.com/repos/slightlyoff/ServiceWorker/issues/687","id":96055203,"user":{"login":"inexorabletash","id":771547,"avatar_url":"https://avatars.githubusercontent.com/u/771547?v=3","gravatar_id":"","url":"https://api.github.com/users/inexorabletash","html_url":"https://github.com/inexorabletash","followers_url":"https://api.github.com/users/inexorabletash/followers","following_url":"https://api.github.com/users/inexorabletash/following{/other_user}","gists_url":"https://api.github.com/users/inexorabletash/gists{/gist_id}","starred_url":"https://api.github.com/users/inexorabletash/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/inexorabletash/subscriptions","organizations_url":"https://api.github.com/users/inexorabletash/orgs","repos_url":"https://api.github.com/users/inexorabletash/repos","events_url":"https://api.github.com/users/inexorabletash/events{/privacy}","received_events_url":"https://api.github.com/users/inexorabletash/received_events","type":"User","site_admin":false},"created_at":"2015-04-24T20:28:10Z","updated_at":"2015-04-24T20:28:10Z","body":"FWIW, in Chrome we still expose the globals, but `self.caches` throws a `SecurityError` on access with details about why the access was denied. This is consistent with what we do for  `window.sessionStorage`, `window.localStorage`.\r\n\r\nFor Indexed DB we instead throw on access to the `open()`/`deleteDatabase()` methods hanging off the `indexedDB` global.\r\n"}}