Allow None as value for Service-Worker-Allowed.

[surma]

In a multi-tenant system, where untrusted users have control over subdirectories, it would be nice to disable ServiceWorkers completely for paths outside the “user’s jail”.

Here’s an example:

/
|
+- /users
   |
   +- /userA
   +- /userB
   +- ...
+- /data
+- ...

A simple oversight like a missing trailing slash (/users/userA instead of /users/userA/) could allow installing a ServiceWorker outside the user’s jail.

Currently, you can kinda disable ServiceWorker by setting a non-sensical value for the Service-Worker-Allowed header, but I’d prefer a more semantic None (or similar).

[jakearchibald]

The problem here is that None is a valid path.

All service worker script fetches have a Service-Worker: script header, so servers can return an invalid response in return.