Allow hashing the filename of sw.js about offline-plugin

[NekR]

You should never cache SW script, as well as you don't cache AppCache's
manifest. Best way to serve SW script is with Cache-Control: no-cache
header, so browser will now that it has to be revalidated each time page
loads.

Even more, you cannot cache SW for more than 24 hours. Maybe you can, of
course, but that cache is ignored by the browsers after 24 hours of last SW
script download.

This is security limitation to not let people do footguns, as you just
wanted to do. Hope it helps.
On May 28, 2016 2:12 AM, "Ole Bjørn Michelsen" [email protected]
wrote:

We are caching all assets with a far-future expire on our webserver.
Therefore we need to hash the service worker script in order to update to
new versions, but this does not seem to work:

new OfflinePlugin({
ServiceWorker: {
output: 'sw-[hash].js'
}
})

Just outputs it literal: sw-[hash].js

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#56, or mute the thread
https://github.com/notifications/unsubscribe/ABIlkZIZnw3AhSrRmiQ_4O89iIZ2T6SEks5qF3pLgaJpZM4Io7a9
.

[omichelsen]

I was just hoping to avoid managing special cache headers for individual files, but makes sense to just not cache it. Didn't know about the max 24h limit.

Thanks for the info, good to know!

[NekR]

@omichelsen you probably don't need to set any cache control headers for SW file, but browsers suggest to set it to no-cache. But if you serve it already with cache headers (e.g. forever cache) then it's better to set on small setting for sw.js to make sure it is's always updated properly, e.g. proxies and CDN may cache it, which will result in forever stale version, etc.