diff --git a/spec/service_worker/index.html b/spec/service_worker/index.html index 7a37f62a..79eb79e8 100644 --- a/spec/service_worker/index.html +++ b/spec/service_worker/index.html @@ -108,7 +108,6 @@

Dependencies

  • (Non-normative) Unsanctioned Web Tracking
  • Push API
  • Augmented BNF for Syntax Specifications: ABNF
    • -
  • Uniform Resource Identifier (URI): Generic Syntax
    • @@ -2518,7 +2517,9 @@

    Update

  • Set r's initiator to "" and destination to "serviceworker".
  • Set r's client to client.
    • -
  • Append `Service-Worker`/`script` to r's header list.
    • +
  • Append `Service-Worker`/`script` to r's header list. +

    See the definition of the Service-Worker header in Appendix B: Extended HTTP headers.

    +
  • Set r's skip service worker flag, r's synchronous flag, and r's redirect mode to "manual".
  • Let newestWorker be null.
  • Set newestWorker to the result of running Get Newest Worker algorithm passing registration as the argument.
    • @@ -2545,7 +2546,9 @@

    Update

  • Abort these steps.
    • -
  • Let serviceWorkerAllowed be the result of parsing `Service-Worker-Allowed` in response's header list.
    • +
  • Let serviceWorkerAllowed be the result of parsing `Service-Worker-Allowed` in response's header list. +

    See the definition of the Service-Worker-Allowed header in Appendix B: Extended HTTP headers.

    +
  • If serviceWorkerAllowed is failure, then:
    1. Reject p with a TypeError.
      2. @@ -3598,7 +3601,7 @@

      Batch Cache Operations

      Appendix B: Extended HTTP headers

      - +

      Service Worker Script Request

      An HTTP request to fetch a service worker's script resource can include the following header:

      @@ -3610,7 +3613,7 @@

      Service Worker Script Request

       - +

      Service Worker Script Response

      An HTTP response to a service worker's script resource request can include the following header:

      @@ -3620,6 +3623,41 @@

      Service Worker Script Response

      The value is a URL. If a relative URL is given, it is parsed against the script's URL.

      + +

      Example: Default scope

      + +// Maximum allowed scope defaults to the path the script sits in +// "/js" in this example +navigator.serviceWorker.register("/js/sw.js").then(function() { + console.log("Install succeeded with the default scope '/js'."); +}); + +

      Example: Upper path without Service-Worker-Allowed header

      + +// Set the scope to an upper path of the script location +// Response has no Service-Worker-Allowed header +navigator.serviceWorker.register("/js/sw.js", { scope: "/" }).catch(function() { + console.error("Install failed due to the path restriction violation."); +}); + + +

      Example: Upper path with Service-Worker-Allowed header

      + +// Set the scope to an upper path of the script location +// Response included "Service-Worker-Allowed : /" +navigator.serviceWorker.register("/js/sw.js", { scope: "/" }).then(function() { + console.log("Install succeeded as the max allowed scope was overriden to '/'."); +}); + + +

      Example: A path restriction voliation even with Service-Worker-Allowed header

      + +// Set the scope to an upper path of the script location +// Response included "Service-Worker-Allowed : /foo" +navigator.serviceWorker.register("/foo/bar/sw.js", { scope: "/" }).catch(function() { + console.error("Install failed as the scope is still out of the overriden maximum allowed scope."); +}); +       diff --git a/spec/service_worker_1/index.html b/spec/service_worker_1/index.html index 5654f6a7..506bfe81 100644 --- a/spec/service_worker_1/index.html +++ b/spec/service_worker_1/index.html @@ -106,7 +106,6 @@

      Dependencies

    2. (Non-normative) Unsanctioned Web Tracking
    3. Push API
    4. Augmented BNF for Syntax Specifications: ABNF
      5. -
    5. Uniform Resource Identifier (URI): Generic Syntax
      6.  @@ -2516,7 +2515,9 @@

      Update

    6. Set r's initiator to "" and destination to "serviceworker".
    7. Set r's client to client.
      8. -
    8. Append `Service-Worker`/`script` to r's header list.
      9. +
    9. Append `Service-Worker`/`script` to r's header list. +

      See the definition of the Service-Worker header in Appendix B: Extended HTTP headers.

      +
    10. Set r's skip service worker flag, r's synchronous flag, and r's redirect mode to "manual".
    11. Let newestWorker be null.
    12. Set newestWorker to the result of running Get Newest Worker algorithm passing registration as the argument.
      13. @@ -2543,7 +2544,9 @@

      Update

    13. Abort these steps.
    • -
  • Let serviceWorkerAllowed be the result of parsing `Service-Worker-Allowed` in response's header list.
    • +
  • Let serviceWorkerAllowed be the result of parsing `Service-Worker-Allowed` in response's header list. +

    See the definition of the Service-Worker-Allowed header in Appendix B: Extended HTTP headers.

    +
  • If serviceWorkerAllowed is failure, then:
    1. Reject p with a TypeError.
      2. @@ -3618,6 +3621,41 @@

      Service Worker Script Response

      The value is a URL. If a relative URL is given, it is parsed against the script's URL.

      + +

      Example: Default scope

      + +// Maximum allowed scope defaults to the path the script sits in +// "/js" in this example +navigator.serviceWorker.register("/js/sw.js").then(function() { + console.log("Install succeeded with the default scope '/js'."); +}); + +

      Example: Upper path without Service-Worker-Allowed header

      + +// Set the scope to an upper path of the script location +// Response has no Service-Worker-Allowed header +navigator.serviceWorker.register("/js/sw.js", { scope: "/" }).catch(function() { + console.error("Install failed due to the path restriction violation."); +}); + + +

      Example: Upper path with Service-Worker-Allowed header

      + +// Set the scope to an upper path of the script location +// Response included "Service-Worker-Allowed : /" +navigator.serviceWorker.register("/js/sw.js", { scope: "/" }).then(function() { + console.log("Install succeeded as the max allowed scope was overriden to '/'."); +}); + + +

      Example: A path restriction voliation even with Service-Worker-Allowed header

      + +// Set the scope to an upper path of the script location +// Response included "Service-Worker-Allowed : /foo" +navigator.serviceWorker.register("/foo/bar/sw.js", { scope: "/" }).catch(function() { + console.error("Install failed as the scope is still out of the overriden maximum allowed scope."); +}); +