fix(service-worker): Preserves explicit 'credentials: omit' in asset … - #68904
Conversation
…requests Ensures that explicitly provided `credentials: 'omit'` options are preserved when creating new requests, preventing unintended credential inclusion.
| }; | ||
|
|
||
| if (options.credentials === 'omit') { | ||
| init.credentials = 'omit'; |
There was a problem hiding this comment.
I'm also wondering whether we should consider cache as well.
For cases like no-store and no-cache, to avoid keeping it in the browser memory for subsequent requests.
Can we see it in a follow PR?
There was a problem hiding this comment.
The question is more: are we fixing a security bug or adding a feature ?
We should only be really fixing bug as this package is now in maintenance mode.
There was a problem hiding this comment.
It's a security flaw, not a feature. I say this because, in a hypothetical scenario where a document or sensitive information is accidentally cached, this could become a potential vulnerability.
Considering that the intention of the request was not to save the information in the browser so that any subsequent request would not receive the request with outdated information (e.g., medical records on a shared computer [This is common in some parts of my country and clinics.], bank statements, etc.)
There was a problem hiding this comment.
Yeah makes sense, let's ship both in this PR as both could be seen as security fixes.
There was a problem hiding this comment.
Updated, I added it as another commit
Ensures explicit HTTP cache mode from incoming requests is forwarded and maintained when creating fetch requests for assets, aligning with expected fetch behavior and preventing unintended cache handling.
|
Given that this case is similar the same attack vector as this issue #68823 I believe we should also backport this pull request ? |
|
Sorry for bothering you @JeanMeche @alan-agius4. I think this should be merged as well so it can make it into today's patch release, since it's also a security issue. |
|
This pull request has been automatically locked due to inactivity. Read more about our automatic conversation locking policy. This action has been performed automatically by a bot. |
fix(service-worker): Preserves explicit 'credentials: omit' in asset requests
Ensures that explicitly provided
credentials: 'omit'options are preservedwhen creating new requests, preventing unintended credential inclusion.
fix(service-worker): Preserves HTTP cache mode in asset group requests
Ensures explicit HTTP cache mode from incoming requests is forwarded and maintained when creating fetch requests for assets, aligning with expected fetch behavior and preventing unintended cache handling.
PR Checklist
Please check if your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
What is the current behavior?
Issue Number: N/A
What is the new behavior?
Does this PR introduce a breaking change?
Other information