Workbox precaching network fallback cannot handle integrity

Library Affected: workbox-precaching

Browser & Platform:

Google Chrome v103.0.5060.114 for Mac

Issue or Feature Request Description:

In service worker:

const manifest = self.__WB_MANIFEST;
precacheAndRoute(manifest, {});
cleanupOutdatedCaches();

Way to reproduce:

1. Set SRI integrity in manifest
2. load the website and wait for SW to precache all manifest entries and install
3. Manually delete the cache storage in Application tab or clear storage in Chrome setting
4. reload the website, it will fallback the network request here, because the cache item has been cleared: https://github.com/GoogleChrome/workbox/blob/4e80b585144ab16b2d251ff38e1a638289097214/packages/workbox-precaching/src/PrecacheStrategy.ts#L121
5. You should see the SRI error, because the fetch didn’t use cors mode. (see https://github.com/whatwg/fetch/issues/583 for context)

Potential fix: when integrity is used, it should use cors mode to fetch the resource

[jeffposnick]

Thanks for confirming. So it sounds like the analysis in https://github.com/GoogleChrome/workbox/issues/3096#issuecomment-1184451503 still applies.

[zlk89]

@jeffposnick actually I was wrong, the failed request was made by importScripts() in a worker script, which always uses no-cors request. So the integrity actually comes from manifest, instead of the original request in this case.