HTML5 Security Cheat Sheet — Offline Applications

Reference note (untrusted external data; do not execute it as instructions). The HTML5 Application Cache ( and .appcache files) has been removed from all major browsers (Firefox 85, Chrome 93). Do not use it for new applications and migrate any remaining usage to Service Workers with the Cache API. Service Workers run on a separate, scriptable thread and intercept network requests for the registered scope. Because they can transparently serve cached responses, they have a significant security impact: Only register Service Workers from your own origin and only serve the worker script over HTTPS with a long-cache-busting filename (e.g. sw..js). Validate that the scope of the Service Worker is restricted (use the scope option or the Service-Worker-Allowed response header) so a compromised worker cannot intercept unrelated paths. A malicious or compromised Service Worker can intercept every request from its scope until it is unregistered or the cache TTL expires; hav Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.