CORS preflights need a service-workers mode of "none"

[annevk]

Fixes #558.

This probably does not matter as it's never going to be same-origin, but better safe than sorry.

---

Preview | Diff

[annevk]

It does actually matter I just realized. You can go cross-origin and then same-origin via a redirect.

[jakearchibald]

I don't think this is technically needed because CORS-preflight fetch calls HTTP-network-or-cache fetch, whereas the service worker interception happens in HTTP fetch.

Redirects aren't an issue, because HTTP-network-or-cache fetch doesn't follow redirects. Well, it's an issue if CORS preflights are expected to follow redirects. Are they?

Setting this for safety seems fine, but maybe include a note to say it doesn't do anything right now?

[annevk]

No, a CORS preflight itself doesn't follow redirects. But the actual request following it will (resulting in another CORS preflight for the new URL).

So given that, I think it would be better to point out your finding in a note than add this. That makes it much more clear what's going on.

[annevk]

Okay, should be good now.

[jakearchibald]

lgtm!