Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ServiceWorker] Skip cache on homepage only when the special auth hash is set #68

Merged
merged 2 commits into from
Apr 22, 2021

Conversation

mallardduck
Copy link
Contributor

Per the issue in: #56 - this PR aims to resolve the Auth workflow with Safari.

As mentioned I found that on Safari the way that they handle "redirect chains" is a bit unique. Rather than reporting the individual Request/Response events, they cluster the whole chain as a single entity.

The secondary aspect of the issue is how the local cache is used in context of the auth workflows. While the serviceworker can correctly ignore most important auth URLs. See:

            request.destination === 'document'
            && !url.pathname.startsWith('/app/')
            && !url.pathname.startsWith('/auth/')
            && !url.pathname.startsWith('/admin/')

The final landing page must be ignored too otherwise we still loose the state due to how Safari handles cross-site cookies. Since the final landing page of the chain is / which is outside of these excludes the page response is handled by the service worker and the cookies get eaten up.

So to prevent that the solutions are either: 1) exclude the homepage, but only when the request is part of the OAuth workflow, or 2) have the GitHub oauth redirect to a URL that can be excluded by path.


Unfortunately the service worker's request doesn't have context to exclude things very cleanly. Initially I was going to exclude based on referrer path, but even though it's "same site" the referrer is only the domain. My second thought was to add a header to the auth response like X-NOJSWORKER: true however the service worker's request also lacks the headers.

So finally I've opted to do a bit of JS magic by having the redirect respond with a #newAuth hash on the URL. The serviceworker will now exclude URLs with that hash value, and then some App side JS will push history state to remove the #newAuth hash from the URL so it remains (mostly) transparent to the user.


Tested this new solution on both Mac Safari (Mac M1 Big Sur) and in the iOS simulators Safari. This solution seems to work correctly in both of those safari environments.

@Gummibeer Gummibeer merged commit dad3238 into Astrotomic:dev Apr 22, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants