← Back to release summary

Secure context fix for dedicated workers

Category
Security
Type
No developer-visible change
Status
Enabled by default (Chrome 101)
Intent stage
Shipped

Summary

Dedicated workers loaded from a secure (HTTPS) origin yet instantiated by insecure (non-HTTPS) contexts are no longer considered secure. This results in the following web developer facing changes inside such worker contexts: - `self.isSecureContext` is now `false` - `self.caches` and `self.storageFoundation` are no longer available This aligns Blink behavior with the specification and Gecko.

Motivation

Blink does not respect the HTML specification in this regard, and is incompatible with Gecko.

Standards & signals

View on chromestatus.com