Discussion: sender.url for Service Worker Senders

[evasu0]

The Chrome Extensions team is looking to align on the sender.url property when messages originate from service workers.

Current Behavior
In the current Chrome Extensions environment, when a message is sent from a service worker, the sender.url property in the receiving end's sender object is undefined. While this behavior could be technically correct since service workers don't execute within the context of a page or frame, it creates limitations for developers who want to differentiate between messages originating from different parts of an extension or debug complex extension architectures.

Currently, Firefox uses script URL for the sender.url when a message is sent from a service worker.

Proposed Solution:

Script URL: Set sender.url to the specific URL of the service worker script (e.g., chrome-extension://<extension_id>/background.js). This offers a more granular identification which could be beneficial for debugging and also aligns with the current behavior in Firefox, but may be unnecessarily detailed for simple use cases.

Alternatives Considered:

1. Extension Origin URL: Set sender.url to the extension's origin URL (e.g., chrome-extension://<extension_id>/). This provides a simple identifier, but is less granular than having a script URL.
2. Introduce documentUrl and scriptUrl properties: We could add new documentUrl and scriptUrl properties to the MessageSender which would offer developers more precise attribution options without overloading the url property.

Questions for Discussion

1. Which approach would be more beneficial for extension developers?
2. What are the primary use cases that would drive this preference?
3. Are there other solutions we should consider?
4. Are there any security implications we should be aware of? Are there potential security benefits or risks of each approach?

[carlosjeurissen]

Seems the Mozilla Firefox approach aligns with location.href (instance of WorkerLocation). Is there any reason not to match this? Are there instances in which extensions currently rely on sender.url being undefined/absent?

Instead of having documentUrl or scriptUrl, it could be more useful to return the contextType of the sender.

[Rob--W]

The "url" of a worker is well-defined, with precedence in the web platform.

Although Firefox does not have service worker support ready yet, its implementation behind a flag does support the extension messaging APIs, and sender.url is set to the URL of the worker: https://searchfox.org/mozilla-central/rev/1eb4f27ece7cb96ac94b635ad0dc95c00d1443db/toolkit/components/extensions/test/xpcshell/test_ext_service_worker_messaging.js#27,34,41,43

[evasu0]

Thanks for the feedback! We’ll go ahead with setting the sender.url to script URL when it's sent from service workers. Safari, feel free to follow-up here if there's any concerns or disagreement.

[kiaraarose]

We'd be supportive of this in Safari