{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/html/issues/1322","repository_url":"https://api.github.com/repos/whatwg/html","labels_url":"https://api.github.com/repos/whatwg/html/issues/1322/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/html/issues/1322/comments","events_url":"https://api.github.com/repos/whatwg/html/issues/1322/events","html_url":"https://github.com/whatwg/html/issues/1322","id":156876758,"number":1322,"title":"Should an opaque origin be able to create a Worker?","user":{"login":"mkruisselbrink","id":5649,"avatar_url":"https://avatars.githubusercontent.com/u/5649?v=3","gravatar_id":"","url":"https://api.github.com/users/mkruisselbrink","html_url":"https://github.com/mkruisselbrink","followers_url":"https://api.github.com/users/mkruisselbrink/followers","following_url":"https://api.github.com/users/mkruisselbrink/following{/other_user}","gists_url":"https://api.github.com/users/mkruisselbrink/gists{/gist_id}","starred_url":"https://api.github.com/users/mkruisselbrink/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mkruisselbrink/subscriptions","organizations_url":"https://api.github.com/users/mkruisselbrink/orgs","repos_url":"https://api.github.com/users/mkruisselbrink/repos","events_url":"https://api.github.com/users/mkruisselbrink/events{/privacy}","received_events_url":"https://api.github.com/users/mkruisselbrink/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/whatwg/html/labels/topic:%20workers","name":"topic: workers","color":"0e8a16"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2016-05-26T00:05:07Z","updated_at":"2016-05-27T17:38:11Z","closed_at":null,"body":"With classic script workers it wasn't possible for a document in a unique origin (such as a sandboxed iframe) to create a `Worker`, as it's impossible for the origin of the script URL to be the same as the (unique) origin of the document. With module workers there currently is no such same-origin requirement though, so as spec-ed it should be possible for a unique origin to create a worker (assuming the worker is served with a `Access-Control-Allow-Origin: *` or `Access-Control-Allow-Origin: null` header). Is this intentional? Or should some of the same origin checks that got removed from the Worker constructor be put back?\r\n@annevk  @domenic "},"comment":{"url":"https://api.github.com/repos/whatwg/html/issues/comments/222208308","html_url":"https://github.com/whatwg/html/issues/1322#issuecomment-222208308","issue_url":"https://api.github.com/repos/whatwg/html/issues/1322","id":222208308,"user":{"login":"annevk","id":1544111,"avatar_url":"https://avatars.githubusercontent.com/u/1544111?v=3","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false},"created_at":"2016-05-27T17:38:11Z","updated_at":"2016-05-27T17:38:11Z","body":"Hmm, I think blob URLs would fail since they carry the origin in the URL. I have no problem with this working either though."}}
{"actor":{"display_login":"annevk"}}