eschutho opened a new pull request, #45856:
URL: https://github.com/apache/superset/pull/45856
### SUMMARY
`spa.html` registered the service worker from `{{ assets_prefix
}}/static/service-worker.js`. When `STATIC_ASSETS_PREFIX` is a different origin
(CDN), browsers reject the registration with `SecurityError: Failed to register
a ServiceWorker ... The origin of the provided scriptURL does not match the
current origin`, logging a console error on every page load. A service worker
script must be same-origin with the page.
The worker is emitted by webpack to `static/service-worker.js` and, once the
frontend bundle is built, is served by Superset's own static route
(`send_static_file`), which also adds `Service-Worker-Allowed: /`
(`superset/initialization/__init__.py`). This PR registers from `{{
application_root_rstrip }}`, the variable the manifest link already uses. Root
and subdirectory deployments render the same URL as before, because `app.py`
backfills `STATIC_ASSETS_PREFIX` to the app root.
Design notes:
- Skipping registration for cross-origin prefixes would also silence the
error, but would disable the worker for CDN deployments. The worker only calls
`skipWaiting`/`clients.claim` and has no fetch handler, so registering from the
app origin does not affect CDN asset caching.
- Scope is intentionally unchanged: `register()` is still called without a
`scope` option, so the scope is the script's directory (`<root>/static/`).
`Service-Worker-Allowed` only permits a wider scope; it does not widen it. The
worker therefore does not control app pages before or after this change
(harmless today, as there is no fetch handler).
- Known, out of scope: registration inside a cross-site embedded iframe may
still be restricted by browsers.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A (non-UI). Rendered output with
`STATIC_ASSETS_PREFIX=https://cdn.example.com`:
- Before: `.register('https://cdn.example.com/static/service-worker.js')`
- After: `.register('/static/service-worker.js')` (`/superset/static/...`
under `APPLICATION_ROOT=/superset`)
### TESTING INSTRUCTIONS
Automated: `pytest tests/unit_tests/views/test_spa_service_worker.py`. The
tests render the real `spa.html` with Jinja, stubbing only the AppBuilder
partials, with and without a CDN prefix. They fail on the pre-fix template for
the CDN cases and pass after.
I ran them with the system Python and `--noconftest` (the full Superset
package was not importable in my environment). The full Flask app render was
not exercised and the change was NOT verified in a browser.
Manual: set `STATIC_ASSETS_PREFIX = "https://cdn.example.com"`, load any
page, and confirm there is no `Service Worker registration failed` console
error and the worker registers from the app origin.
### ADDITIONAL INFORMATION
- [ ] Has associated issue: (no existing issue found)
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
