Add utility to upgrade requests to cors

[wheresrhys]

One thing I'm not comfortable doing with service workers is caching opaque responses. In any other caching layer I would never consider caching responses without checking if they were good, but opaque responses allow no access to the success of the response. This is the default scenario when seeking to cache requests for cross domain scripts, styles and images... a significant portion of the requests I'd like to cache.

This utility https://github.com/Financial-Times/n-service-worker/blob/master/src/utils/handlers.js#L5-L13 gives the ability to upgrade requests to cors, though can only be applied to domains where I have control over the cors headers.

Could something similar be of use in sw-toolbox?

[jeffposnick]

My initial reaction is that it developers who want that guarantee should explicitly add the crossOrigin attribute to the relevant resources in the DOM.

That has the benefit of preventing situations in which the resource can be fetched when there's no SW but fails when the SW is in installed. That would happen when the remote server doesn't support CORS.

[wheresrhys]

Thanks for the tip. I hadn't realised it was available on elements other than <link>. But many of the resources I'd like to cache are CSS background images, which I guess can't be given this treatment.

That would happen when the remote server doesn't support CORS.

My use cases for this are on a subdomain I have control over, so this isn't a problem for me. Serving assets from a different subdomain is quite a common pattern, so it could well be useful for others too (With http2 this will become an anti-pattern, but I suspect many sites will invest in adding SW before they invest in single domain http2).

I'm not suggesting my utility is a good solution to the problem, more a hack to cope with the lack of information about response statuses while waiting for foreign fetch to arrive. FWIW, I'm not convinced foreign fetch is a great solution either, and would like to give servers the ability to tell the browser, via a header, that it's OK to give JS access to the status, because the security concerns that have ruled this out so far seem quite niche to me