[ServiceWorker] Skip cache on homepage only when the special auth hash is set #68
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Per the issue in: #56 - this PR aims to resolve the Auth workflow with Safari.
As mentioned I found that on Safari the way that they handle "redirect chains" is a bit unique. Rather than reporting the individual Request/Response events, they cluster the whole chain as a single entity.
The secondary aspect of the issue is how the local cache is used in context of the auth workflows. While the serviceworker can correctly ignore most important auth URLs. See:
The final landing page must be ignored too otherwise we still loose the state due to how Safari handles cross-site cookies. Since the final landing page of the chain is
/
which is outside of these excludes the page response is handled by the service worker and the cookies get eaten up.So to prevent that the solutions are either: 1) exclude the homepage, but only when the request is part of the OAuth workflow, or 2) have the GitHub oauth redirect to a URL that can be excluded by path.
Unfortunately the service worker's
request
doesn't have context to exclude things very cleanly. Initially I was going to exclude based on referrer path, but even though it's "same site" the referrer is only the domain. My second thought was to add a header to the auth response likeX-NOJSWORKER: true
however the service worker's request also lacks the headers.So finally I've opted to do a bit of JS magic by having the redirect respond with a
#newAuth
hash on the URL. The serviceworker will now exclude URLs with that hash value, and then some App side JS will push history state to remove the#newAuth
hash from the URL so it remains (mostly) transparent to the user.Tested this new solution on both Mac Safari (Mac M1 Big Sur) and in the iOS simulators Safari. This solution seems to work correctly in both of those safari environments.