should prefetch loads trigger FetchEvents?

[wanderview]

Lately I noticed some odd additional FetchEvents in chrome on https://fetch-event-echo.glitch.me:

https://bugs.chromium.org/p/chromium/issues/detail?id=832105

I think these might be prefetch loads.

This got me wondering, should prefetch trigger a FetchEvent? What is the clientId? What is the resultingClientId?

On the one hand, prefetch seems to be defined for a document via the tag:

https://w3c.github.io/resource-hints/#prefetch

However, does it really make sense to "prefetch" a resource through the service worker? I was under the impression that prefetch was really there to optimize loading resources over the network. Does dispatching a FetchEvent for these loads just slow down the network optimization for no reason?

[jyasskin]

I also filed a similar issue as w3c/resource-hints#78. As far as I can see, the flow is not specified and not tested in WPT. @kinu described the Chrome implementation as:

1. Page A embeds
2. B is fetched as a subresource through A's Service Worker. If this is a real response (i.e. A's SW can't fake a cross-origin response), it's entered into a HTTP cache with a minimum 5-minute lifetime.
3. User clicks link to C.
4. If C requests B, that request goes through C's SW.
5. If C's SW forwards the request to the network, it'll find the prefetched response in the HTTP cache.

[annevk]

FWIW, I do somewhat have the expectation that the service worker is consulted about all network traffic, similarly to CSP being able to control all of it.

The service worker is a bit more limited as dns-prefetch or some such would bypass it, but this doesn't seem like something that would need to bypass it.

[tomayac]

Should cookies be sent/dropped for through-Service-Worker-prefetched requests? The MDN Link Prefetching FAQ state that cookies would be accessed for regular prefetches, so I guess the same would apply here. Does this change the privacy implications?

[wanderview]

A service worker can store things in IDB, make unrelated network requests, etc. So I think it has wider privacy implications than normal cookies. Its probably important that we don't trigger a different origin service worker based on only a <link> element here. Or if we do, allow the browser to knowingly handle it like loading an iframe so 3rd party content policies can be enforced.