Credentials on scripts imported by importScripts()
Nobody has claimed this yet.
- Dominant language
- Bikeshed
- Stars
- 3.6k
- Forks
- 324
- Avg merge
- 14d 22h
- Merged PRs (30d)
- 1
Description
This is similar to https://github.com/whatwg/html/issues/2557.
Chrome now has a bug around the credentials mode (issue), and I'm now wondering what is the correct value for the request's credentials mode.
As far as I read the spec, importScripts() uses fetch a classic worker-imported script which doesn't set any value to the credentials mode, while the main script is set to "same-origin". The default value of the request's credentials mode is "omit", so I think it's "omit".
I implemented the byte-for-byte checking in that way recently, but found that the existing implementation seems to use "include".
What would be the best value for that?
So far, I'm feeling that using "same-origin" would be less confusing.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked HTML sections for “fetch a classic worker-imported script” and “fetch a classic worker script,” then compare their credentials-mode handling with the linked Fetch default. Determine which mode the specification should require for importScripts(), and document the resolved behavior so the byte-for-byte checking implementation and existing behavior can be aligned.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html, javascript
- Domain
- web-dev
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100