webrowser - service workers

Costas

Administrator
Staff member
-why ?
-because. ( w3c / w3c.explained / developer.mozilla / google.service worker overview / chromium.service worker security faq / angular service worker introduction )

@2014 - At their simplest, Service Workers are scripts that act as client-side proxies for web pages. JavaScript code can intercept network requests, deliver manufactured responses and perform granular caching based on the unique needs of the application, a feature that the web platform has lacked before now. src

there is also SharedWorker. This can be disabled on Chrome starting it with cmd line :
chrome.exe --disable-shared-workers

--

On Firefox can be disabled completely by going to
about:config

and set false to
dom.serviceWorkers.enabled
dom.webnotifications.serviceworker.enabled
extensions.backgroundServiceWorker.enabled

You can see the registered at
about:serviceworkers
or
about:debugging#/runtime/this-firefox
or
devtools > Application

On Chrome is not possible, the only way is to use an addon (not good idea). Also you can navigate to
chrome://serviceworker-internals/
or
devtools > Application
to see the register ones and if you like unregister one by one.

service workers store data to
C:\Users\user\AppData\Local\Chome\User Data\Default\Service Worker
on a test machine was 787mb (just close the browser and delete the folder)

Till Chrome 2019 there was an experimental option, could be accessed with:
chrome://flags/
named
Servicified service workers
Description : Enable the servicified service workers. A servicified service worker can have direct connection from its clients, so that fetch events can be dispatched through the connection without hopping to the browser process.
but not exists anymore..



Some suggest, uBlock rule [mirror], this is made through the Content Security Policies (CSP) search for worker-src where writes :
Restricts the URLs which may be loaded as a Worker, SharedWorker or ServiceWorker.
Con : Worker is mandatory and needed (used for concurrent or parallel processing -- is similar to C# threads)

tested with Brave ( brave://settings/shields/filters ) and working

ySffQtO.png

||$csp=worker-src 'none'

In detail what is CSP :
When a browser makes a request to a website, the website responds with a Content Security Policy (CSP) header in the HTTP response. This header contains directives that instruct the browser on the allowed sources for various types of content, such as scripts, styles, and images, helping to prevent malicious code execution and enhance security. Somehow the uBlock squeeze this tag, there is no trace on devtools. CSP Header with PHP

steps :
  • ctrl+shift+del - clean everything
  • make the adjustment on filters
  • close the browser
  • (optional) goto profile folder, delete the mentioned folder
--

Angular PWA - test
https://julienboulay.github.io/ngsw-brave/

(2018) - Intro To Service Workers & Caching

refs :
(2017) - Is there any reason not to disable Service Workers?
(2018) - How to disable Service Workers
(2020) - High CPU usage from drive/docs service workers (Chrome v88 bug)
(2021) - https://popzazzle.blogspot.com/2021/11/dark-tracking-service-workers-and-privacy.html
(2022) - :ninja: MarkZ Experience - Block Service Workers
(2023) - Abusing Service Workers
(2023) - US senator - Governments spying on Apple, Google users through push notifications
(2023) - Apple & Google Monitor All Your Push Notifications
 

Costas

Administrator
Staff member
seems that if we play with the permissions of the

C:\Users\user\AppData\Local\Chome\User Data\Default\Service Worker

folder, the Chrome is unable to use service workers and the normal workers (which is mandatory) still working.

In nutshell how to adjust the permissions (if something goes wrong delete the folder, will be created once you will visit a page with service worker)

then when visiting a test page, writes success received by the browser, but in reality, could not make it ;)
fhNS0ZC.png


Test Worker / Shared Worker / Service Worker
https://worker-playground.glitch.me/
 
Top