From https://example.com/main.html,
new Worker('http://example.com/worker.js')
should be successful if upgrade-insecure-requests is specified,
because upgrading is done at Step 2.3 of main fetch
https://fetch.spec.whatwg.org/#main-fetch
which is before same-origin check at Step 5 of main fetch
that ensures same-originness of workers.
However, in Blink the same-originness check is done in AbstractWorker before going into platform/loader (i.e. before upgrading), and therefore the worker above is rejected.
I file this as I found this during adding test coverage (and thus I'm adding a WPT test failing due to this issue), but I expect the priority is quite low.
Probably this will be fixed once we remove ad-hoc origin checks outside platform/loader (Issue 875153).
Comment 1 by falken@chromium.org
, Dec 27