Hi, are you able to provide a PoC to demonstrate the issue you're reporting?

falken@, can you please triage. If not a bug, please WontFix.

If this works, it's a bug. heienbrockjannis, can you provide a POC?

Also can you try in Chrome 69? We've recently changed it so navigator.serviceWorker is not even exposed on HTTP sites.

Please excuse the late reply, I did not have that much time lately.
I'll do another test tomorrow at Version 69 and upload the example code.

Link the user the first time to the https site with the fake SSL certificate.
The code will register the serviceworker and link the user to the http site.

Deleted: index.html 193 bytes

index.html 193 bytes View Download

Deleted: sw.js 1.1 KB

sw.js 1.1 KB View Download

Deleted: main.js 916 bytes

main.js 916 bytes View Download

sharing this bug

heienbrockjannis@: Thanks for following up. Can I just confirm that the http site isn't localhost or another local origin like 127/8? Chrome has an exception for http://localhost.

Could you paste output from chrome://serviceworker-internals that shows the service worker registered for the https site?

I'm wondering if the POC requires the first step where you go to an https site with a fake SSL certificate. If you have a real SSL certificate there, does the bug no occur?

I don't immediately know how to make a remote non-localhost https server with a bad certificate, so just wanted to confirm this first.

"registered for the https site" -> "registered for the http site"

To the bug reporter: Are you able to provide us any further information to help us understand this, such as that requested in comment 7?

falken@: I try it on the localhost and a another privat test server. 
Current i can't test it on public server.

Yes you also can use a real SSL certificate. The point is that you can do it also when chrome log an error. After the error on https you can not use the service worker, on http you can use it.

I couldn't reproduce the issue on Chrome 69. What I did:
- Configure nginx to listen to both http (port 80) and https (port 443) on my machine.
- Download files attached in comment #5 and put them into the document root of nginx (main.js -> js/main.js).
- Navigate to the machine like https://192.168.1.100.
- The page redirected to http://192.168.1.100. navigator.serviceWorker is undefined.

Please let me know if I miss something.
(As noted in comment #7, Chrome has an exception for localhost/127.0.0.1)

Thanks bashi@ for looking. That's also the behavior I'd expect.

Bashi, that was the correct way. 

Thanks heienbrockjannis@. I'll close this as WontFix since http localhost is considered secure and we couldn't repro on http non-localhost. Let me know if I'm missing something.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot