search

GoogleChrome / web.dev

The frontend, backend, and content source code for web.dev
https://web.dev
Other
3.56k stars 1.58k forks source link

Security of PWA at client side #7080

Closed prafagr closed 2 years ago

prafagr commented 2 years ago

I am little new to PWA world. I would like to know if we have some controls that are in place to ensure that if someone changes the files are have been downloaded at the client side are not changed and their integrity is ensured. I am aware of the fact that a hashmap of production files is created and the service worker is supposed to validate the hashmap against the local copy. But my concern is around the point that it is possible to modify the JS file corresponding to service worker itself. When we draw an analogy to native applications we have concept of code signing. Do we have something similar here?

rachelandrew commented 2 years ago

Hi @prafagr this repo is for issues to do with the content of the web.dev site, rather than a good place to ask questions. I'd suggest posting to https://stackoverflow.com/questions/tagged/progressive-web-apps