Preserve explicit referrer policy when the service worker reconstructs asset requests for cache-busted and redirected asset fetches.
For example, an application can load a script or image with referrerPolicy: 'same-origin' or 'origin' to limit referrer data. Dropping that policy can expose more of the current URL to that resource host.
(cherry picked from commit a7f52e5c30)
Preserve referrer metadata when the service worker reconstructs asset requests for cache-busted and redirected asset fetches.
For example, an attacker with access to asset host logs could receive a reset token embedded in a page URL if the reconstructed request falls back to default referrer behavior instead of carrying referrer: ''.
(cherry picked from commit 99ad47e58f)
Removes `Authorization`, `Cookie`, and `Proxy-Authorization` headers when a request is redirected to a different origin. This aligns with the Fetch API's redirect algorithm to prevent sensitive information from being sent to third-party origins.
(cherry picked from commit 423a109404)
Ensures explicit HTTP cache mode from incoming requests is forwarded and maintained when creating fetch requests for assets, aligning with expected fetch behavior and preventing unintended cache handling.
Preserve the redirect mode when rebuilding asset requests in newRequestWithMetadata(). This keeps explicit redirect:error semantics intact across service-worker redirect handling.
Update the worker test mocks to model redirect defaults correctly and add focused regression coverage for redirected lazy assets with redirect:error.
Adds handling and logging for unhandled promise rejections to improve debugging and prevent silent failures. Updates tests and test harness to verify logging of rejection reasons
PR Close#63059
Enables specifying the script type ('classic' or 'module') when registering Service Workers, improving compatibility with ES module features.
PR Close#62831
In this commit, we align the service worker types with those provided by TypeScript. The `ServiceWorkerContainer.getRegistration()` method returns a `Promise<ServiceWorkerRegistration | undefined>`, but we were casting it to `Observable<ServiceWorkerRegistration>`, ignoring the possibility of `undefined`.
This is unsafe, as we should account for the case where the registration is `undefined` and handle it appropriately in the push manager.
PR Close#62497
Add client notification when an app version fails, improving error
visibility and debugging capabilities. When a version encounters a
critical error, all clients using that version are now notified
with details about the failure.
- Add notifyClientsAboutVersionFailure method call in versionFailed
- Ensure clients receive VERSION_FAILED events with error details
- Improve service worker error transparency for better debugging
PR Close#62718
Adds proactive storage capacity checks using the Storage API
to better handle near-full conditions during data caching.
Replaces previous TODOs with actual usage monitoring and
logging to help prevent cache failures due to quota exhaustion.
PR Close#62737
Enables configuration of the updateViaCache setting for service worker registration, allowing greater control over caching behavior during updates. Extends tests to cover new option and ensures correct propagation in registration logic.
PR Close#62721
In this commit, support for `pushsubscriptionchange` events has been added to the service worker Driver.
When the push subscription changes, the Driver now captures the event and broadcasts a `PUSH_SUBSCRIPTION_CHANGE` message to clients. This ensures the application is aware of push events and can react accordingly.
Unfortunately, it's not possible to perform any end-to-end testing of this feature.
The push subscription change event exists in both Blink and Gecko. It is also supported in the latest version of Chrome, which means we can give users the ability to react to this event in order to gather feedback on whether other components might need updates.
PR Close#61856
In this commit, we mark the `SwPush` and `SwUpdate` classes as root providers. As a result, they are no longer statically referenced in the `provideServiceWorker` providers list, which previously forced them to be explicitly bundled into the main file. These classes might never be used—some consumers may use the service worker only for prefetching and caching assets.
Practically speaking, even if a user injects the `SwPush` class without calling `provideServiceWorker()`, it would result in a DI error because the communication channel dependency is not available. There is no practical reason to keep these classes as non-root providers or to reference them explicitly.
Currently, some users work around this by using `patch-package` to modify the service worker code and remove these classes from the providers list.
PR Close#61670
Previously, multiple simultaneous calls to `checkForUpdate()` could result in redundant
fetches and hashing of the update manifest, leading to unnecessary network and CPU usage.
This change introduces a mechanism to track an in-progress update check using a cached
promise (`ongoingCheckForUpdate`). Subsequent calls to `checkForUpdate()` while a check
is in progress will return the same promise instead of triggering a new request.
Once the check completes (successfully or not), the cached promise is cleared,
allowing future update checks to proceed normally.
This improves efficiency and prevents overlapping update logic in applications that
may invoke `checkForUpdate()` from multiple sources (e.g. polling, manual triggers).
PR Close#61443
In this commit, support for `notificationclose` events has been added to the service worker Driver.
When a notification is closed (either by user dismissal or programmatically), the Driver now captures the event, extracts the relevant notification options, and broadcasts a `NOTIFICATION_CLOSE` message to clients. This ensures the application is aware of notification lifecycle events and can react accordingly.
PR Close#61442
This update ensures that the service worker can handle range requests, allowing video seeking to work correctly when videos are delivered by the service worker.
PR Close#60029
Prevents esbuild generated metadata files from being included in build artifacts. This reduces package size and avoids shipping unnecessary internal build data.
PR Close#61636
In this commit, we check whether the application is destroyed before calling `serviceWorker.register(...)`. We should not register the worker because other resources will not be available.
PR Close#61101
We don't need this tooling anymore because we are already validating
that there are no circular dependencies via the `ng-dev` tooling that
checks `.ts` files directly.
Also these tests never actually failed to my knowledge.
PR Close#61156
SkyZeroZx