27377 2014-11-20 09:53:31 +0000 MessageEvents in and out of workers should have origin set so we can have cross-origin workers at some point (and then you no longer need to special case same-origin workers) 2014-11-25 00:33:06 +0000 1 1 1 Unclassified WHATWG HTML unspecified Other other RESOLVED INVALID https://html.spec.whatwg.org/#workers P3 normal Unsorted 1 contributor ian annevk hillbrad ian mike contributor oldest_to_newest 115193 0 contributor 2014-11-20 09:53:31 +0000 Specification: https://html.spec.whatwg.org/multipage/workers.html Multipage: https://html.spec.whatwg.org/multipage/#workers Complete: https://html.spec.whatwg.org/#workers Referrer: https://html.spec.whatwg.org/multipage/ Comment: MessageEvents in and out of workers should have origin set so we can have cross-origin workers at some point (and then you no longer need to special case same-origin workers) Posted from: 80.218.216.100 by annevk@annevk.nl User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:36.0) Gecko/20100101 Firefox/36.0 115194 1 annevk 2014-11-20 09:53:57 +0000 http://lists.w3.org/Archives/Public/public-webappsec/2014Nov/0309.html 115257 2 ian 2014-11-20 20:42:15 +0000 That seems contrary to the capabilities model that Workers are intended to provide. Can you elaborate on how you would use this origin? Suppose someone creates a channel in one worker and sends the port back to the page, then later decides it should actually implement its side of the contract by offloading the work to another work. Should the origin change if the other worker in question is in another origin? (This can happen today using iframes, e.g.) 115267 3 annevk 2014-11-21 07:00:33 +0000 Interesting. I had forgotten about it being capability-based. 115338 4 ian 2014-11-21 23:59:59 +0000 So does that mean this is WONTFIX? 115340 5 hillbrad 2014-11-22 00:08:34 +0000 Why shouldn't the behavior be the same for workers as for iframes? 115413 6 ian 2014-11-24 18:44:41 +0000 The behaviour _is_ the same, no? MessagePort doesn't care where the message comes from. Am I missing something? 115435 7 hillbrad 2014-11-25 00:33:06 +0000 I think I understand now - the default channel associated with a worker, accessible via postMessage(), is a MessageChannel. It does not set the origin of messages because it is not being invoked on a Window object. I see this behavior is consistent with iframes. Thanks for the patience. Anne is quicker at opening bugs than I am at building out my test matrix and understanding all the nuances of what they're telling me. :)