New issue
Advanced search Search tips

Issue 918868 link

Starred by 2 users

Issue metadata

Status: Available
Owner: ----
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug

Blocking:
issue 910708



Sign in to add a comment

SplitCache: Get TopFrameOrigin for shared & service workers

Project Member Reported by jkarlin@chromium.org, Jan 3

Issue description

We want to prevent worker clients with different top-frame origins from being able to share the net stack's disk cache entries.

A desirable solution is to isolate worker contexts based on the top-frame origin. In other words, a shared worker created on page a.com is isolated from (a separate instance) to a shared worker created on b.com with an iframe of a.com. 

An alternative solution is to simply not cache requests from shared workers.
 
Are "top-frame origins" essentially browser tabs?

If so, I don't think there is any way to reliable way to require all javascript contexts to strictly map to a single browser tab.  SharedWorker and ServiceWorker can be associated with any combination of top level and third-party documents.  These associations can mutate over time.

Disabling all http caching for SharedWorker and ServiceWorker seem excessively punative.  I think we would very likely see product-level regressions in the ServiceWorker case.

Also, if we care about not leaking information from one http cache partition to another we also have to look at communication channels.  In addition to postMessage() with SharedWorker and ServiceWorker we also have BroadcastChannel.  And we also can communicate by sticking things in origin storage.

You very rapidly reach a condition where you need a full partition mechanism.

FWIW, we had a very similar debate at mozilla about this topic as well:

https://bugzilla.mozilla.org/show_bug.cgi?id=1437626
What I proposed above is to change the spec for shared workers and service workers such that all of a worker's clients must have the same top-frame origin. If they have different origins, then a new worker instance is created. I don't know how feasible that really is or how much it might break sites (or developer minds). It's just a thought.

If we were to do that, then we'd need to prevent communication with other workers w/ different top frame origins. Which means postMessage, broadcastChannel, indexeddb, cacheStorage, localStorage, etc. I agree. Which is why I posited the simpler solution, which is to simply prevent disk caching for shared workers, at least for experimentation purposes. If we decide down the road that full isolation would be beneficial then we could look at that.


Comment 3 by falken@chromium.org, Jan 17 (6 days ago)

Components: Blink>Workers

Sign in to add a comment