Repro: SW answers cross-origin fetches (CORP / CORS after Hono 404 fallback)

Minimal vrowzer 0.1.3 host on Vite 8.1.5.

• Issue: https://github.com/kazupon/vrowzer/issues/28
• Repo: https://github.com/kazupon/vrowzer-repro-issue-28

The host is a shell. Preview files go to ready({ files }). After the Service Worker is listening, the host page (the document the SW controls) runs every destination / mode row from the issue.

src / fetch / import() happen after ready(), so this is not a race with listen().

Run

pnpm install
pnpm dev

If you copied this folder into another pnpm workspace, use pnpm install --ignore-workspace.

Open http://localhost:5173/ (not 127.0.0.1).

• Default: Vrowzer ON (SW listening).
• http://localhost:5173/?nosw=1: unregister the SW and probe again (native baseline).

The asset origin is http://127.0.0.1:4174. No response has Cross-Origin-Resource-Policy. @vrowzer/vite-plugin already sends COOP/COEP.

Header split:

kind	examples	Access-Control-Allow-Origin
no-cors	<img>, CSS background-image, <audio>, <video>, fetch({ mode: 'no-cors' }), sendBeacon	omitted
cors	FontFace, <link rel=stylesheet>, import(), <track>, fetch() JSON	*

A page-initiated CORS request would succeed on the cors rows. The SW respondWith(fetch()) path is what fails.

Actual (Vrowzer ON)

crossOriginIsolated is true. ready() succeeds. Same-origin /local.png still loaded.

Cross-origin rows should error (or queued + a CORP console line for sendBeacon). Typical console:

The FetchEvent for "http://127.0.0.1:4174/…" resulted in a network error response:
Cross-Origin-Resource-Policy prevented from serving the response to the client
net::ERR_FAILED

blob: fetch is a non-http control. ?nosw=1 should load the http(s) rows.

<iframe> often fires load even when the body is blocked; look at the iframe box and the CORP line.

Tiny <audio> / <video> files may report loaded (network ok, decode fail) when the bytes arrive. error / MediaError 2 is the SW/CORP failure.

Expected

The SW leaves cross-origin FetchEvents unanswered. Every row matches ?nosw=1.

Notes

• Vrowzer’s preview iframe is credentialless; its fetches may not go through the host SW. The table is on the host document.
• optimizeDeps.exclude is only so Vite 8 can boot (*.mjs?raw, vrowzer#13). It is not this bug.
• fixtures/font.woff2 is Inter Latin 400 from @fontsource (OFL-1.1), only so FontFace.load() can succeed when the network is native.