-
Notifications
You must be signed in to change notification settings - Fork 385
Description
CC: @slightlyoff
The current specification for an opaque filtered response requires that the status always be set to 0. Could this be relaxed?
I understand that the restriction is in place to prevent leaking information that wouldn't otherwise be available for non-CORS requests/responses, but exposing either the actual HTTP response code or a boolean success/error would be very useful, and may not(*) leak more information that could already be inferred via the onerror/onload handlers for elements like <img> and <link>.
As it's currently implemented, when fetch()ing a non-CORS request from the context of a Service Worker, it's not possible to make an informed decisions about whether the filtered opaque response should be cached or not. Blindly caching a (possibly transient) error response isn't ideal, but the other extreme of not caching any filtered opaque responses runs counter to the utility of Service Workers.
(*It's entirely possible that I'm missing some important privacy implications.)