Is it possible to register a service worker in a friendly iframe?

Question

Is it possible to register a service worker from inside a friendly iframe?

What is a friendly iframe:

A friendly iframe is an iframe that shares the same domain as the main page it is hosted on. This generally means that the content is trusted and hence, can 'break out' of the iframe and manipulate the content on the hosting page.

Generally speaking serviceWorker has a register method which takes in a string .

so it make sense i can pass a full absolute path http://myowndomain.com/myserviceworker.js

for clarification myowndomain.com is different from the hosting frame domain.

serviceWorker
 .register('http://myowndomain.com/myserviceworker.js')
  .then(serviceWorker => {
   console.log(serviceWorker);
  }
})

and scope it globally. (control the current page by not passing scope to options object for the serviceWorker).

will it work?

if so, isn't it a security venerability?

Answer 1

so it make sense i can pass a full absolute path http://myowndomain.com/myserviceworker.js

for clarification myowndomain.com is different from the hosting frame domain.

Neither an <iframe> nor a window can register a service worker for an origin other than the origin of that <iframe> or window .

There is no scenario in which passing in a URL that includes an origin to navigator.serviceWorker.register() will lead to special behavior.

• If the URL has an origin that's different than the origin of the navigator , then the register() call will fail.
• If the URL has an origin that's the same as the origin of the navigator , then the register() call will succeed, but you might as well just leave out the origin portion of the URL, and just pass in an absolute path (ie '/serviceworker.js' ) instead.