thePR0M3TH3ANandClaude Fable 5 b616068689 Service worker: precache with cache:'reload' so 304s can't bake stale headers ...

Diagnosed live: after the CSP fix deployed, a client's SW precached the new
release but cryptoWorker.js revalidated to a 304 (bytes unchanged across
the deploy) and kept its OLD stored headers -- including the
pre-'wasm-unsafe-eval' Content-Security-Policy. A dedicated worker runs
under its own script response's CSP, so Argon2id still could not compile
even though every page and the origin server carried the fixed policy.

cache:'reload' forces full network fetches during install, so cached
responses always carry the headers current at install time. The sw.js byte
change also makes every installed client -- poisoned ones included --
reinstall into the same-named cache, overwriting the stale-header entries.

Co-Authored-By: Claude Fable 5 <[email protected]>

2026-08-04 10:05:14 -04:00

..

core

Pin that pre-removal passwords still sign in

2026-07-31 22:04:01 -04:00

demo

Service worker: precache with cache:'reload' so 304s can't bake stale headers

2026-08-04 10:05:14 -04:00

widget

Fix live login: allow WASM compilation under the deployment CSP

2026-08-04 09:55:49 -04:00