{"action":"created","issue":{"url":"https://api.github.com/repos/slightlyoff/ServiceWorker/issues/754","labels_url":"https://api.github.com/repos/slightlyoff/ServiceWorker/issues/754/labels{/name}","comments_url":"https://api.github.com/repos/slightlyoff/ServiceWorker/issues/754/comments","events_url":"https://api.github.com/repos/slightlyoff/ServiceWorker/issues/754/events","html_url":"https://github.com/slightlyoff/ServiceWorker/issues/754","id":108963303,"number":754,"title":"Make secure context requirements more explicit","user":{"login":"mkruisselbrink","id":5649,"avatar_url":"https://avatars.githubusercontent.com/u/5649?v=3","gravatar_id":"","url":"https://api.github.com/users/mkruisselbrink","html_url":"https://github.com/mkruisselbrink","followers_url":"https://api.github.com/users/mkruisselbrink/followers","following_url":"https://api.github.com/users/mkruisselbrink/following{/other_user}","gists_url":"https://api.github.com/users/mkruisselbrink/gists{/gist_id}","starred_url":"https://api.github.com/users/mkruisselbrink/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mkruisselbrink/subscriptions","organizations_url":"https://api.github.com/users/mkruisselbrink/orgs","repos_url":"https://api.github.com/users/mkruisselbrink/repos","events_url":"https://api.github.com/users/mkruisselbrink/events{/privacy}","received_events_url":"https://api.github.com/users/mkruisselbrink/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-09-29T21:25:30Z","updated_at":"2015-09-30T08:55:55Z","closed_at":null,"body":"It is not clear to me what the current spec actually requires when it comes to secure contexts. Other than for the cache API, the only mention on restrictions wrt secure contexts seems to be this paragraph:\r\n\r\n> Service workers should execute in secure contexts, and the controlled service worker clients should also be secure contexts. This effectively means that service workers and their service worker clients should be hosted over HTTPS. The user agents may allow localhost, 127.0.0.0/8, and ::1/128 for development purpose. (Note that they are still secure contexts.) The primary reason for this restriction is to protect users from the risks associated with insecure contexts.\r\n\r\nThe first thing I'm confused about is why this is only a \"should\", while secure context checks for the cache API are phrased as a \"must\"?\r\n\r\nBut more importantly, I'm not sure what requirements this is actually trying to impose on which parts of the API. For one this paragraph doesn't seem to say anything at all about \"uncontrolled service worker clients\" (not sure if there is such a thing), or more in general which parts of the API should be available to contexts that run in the same origin as a service worker, but that are not secure contexts. From just reading that paragraph I'm led to believe that insecure contexts should be able to call pretty much every method, get access to existing SW registrations, postMessage to them, etc.\r\n\r\nBut I've been told (in slightlyoff/BackgroundSync#90) that the intention of the paragraph is to completely disallow access to any API surface from insecure contexts. If that is indeed the intended behavior, could that maybe be specified somehow?"},"comment":{"url":"https://api.github.com/repos/slightlyoff/ServiceWorker/issues/comments/144331527","html_url":"https://github.com/slightlyoff/ServiceWorker/issues/754#issuecomment-144331527","issue_url":"https://api.github.com/repos/slightlyoff/ServiceWorker/issues/754","id":144331527,"user":{"login":"jungkees","id":1331169,"avatar_url":"https://avatars.githubusercontent.com/u/1331169?v=3","gravatar_id":"","url":"https://api.github.com/users/jungkees","html_url":"https://github.com/jungkees","followers_url":"https://api.github.com/users/jungkees/followers","following_url":"https://api.github.com/users/jungkees/following{/other_user}","gists_url":"https://api.github.com/users/jungkees/gists{/gist_id}","starred_url":"https://api.github.com/users/jungkees/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jungkees/subscriptions","organizations_url":"https://api.github.com/users/jungkees/orgs","repos_url":"https://api.github.com/users/jungkees/repos","events_url":"https://api.github.com/users/jungkees/events{/privacy}","received_events_url":"https://api.github.com/users/jungkees/received_events","type":"User","site_admin":false},"created_at":"2015-09-30T08:55:55Z","updated_at":"2015-09-30T08:55:55Z","body":"> But more importantly, I'm not sure what requirements this is actually trying to impose on which parts of the API.\r\n\r\nI think it depends on this discussion: https://github.com/slightlyoff/ServiceWorker/issues/754#issuecomment-144329370. If it turns out the minimum requirement there is enough, additional guards in the method for secure context would not be required. Otherwise, I can add them where they make sense.\r\n\r\n> \"uncontrolled service worker clients\" (not sure if there is such a thing)\r\n\r\n_Service worker clients_ as a spec concept is just an environment settings object. An uncontrolled client is a client within the same origin but currently uncontrolled as like it's out-of-scope. One such client can be gotten by e.g.:\r\n`self.clients.matchAll({ includeUncontrolled: true })`.\r\n\r\nI agree this text (\"the controlled service worker clients should also be secure contexts\") should be clarified too. Thanks for having pointed them out.\r\n\r\n/cc @slightlyoff @jakearchibald "}}