Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b02d6f0d8dbbb2b69e2a742d32e59beefbb371f4
https://github.com/WebKit/WebKit/commit/b02d6f0d8dbbb2b69e2a742d32e59beefbb371f4
Author: Anthony Tarbinian <[email protected]>
Date: 2026-07-21 (Tue, 21 Jul 2026)
Changed paths:
A
LayoutTests/http/tests/storageAccess/resources/deferred-storage-access-revocation-test.js
A
LayoutTests/http/tests/storageAccess/resources/request-storage-access-and-report-client-side-cookies-iframe.html
A
LayoutTests/http/tests/storageAccess/revoke-storage-access-deferred-until-failed-navigation.https-expected.txt
A
LayoutTests/http/tests/storageAccess/revoke-storage-access-deferred-until-failed-navigation.https.html
A
LayoutTests/http/tests/storageAccess/revoke-storage-access-deferred-until-slow-navigation.https-expected.txt
A
LayoutTests/http/tests/storageAccess/revoke-storage-access-deferred-until-slow-navigation.https.html
M LayoutTests/ipc/loadping-firstpartyforcookies-message-check.html
M LayoutTests/platform/ios-site-isolation/TestExpectations
M LayoutTests/platform/mac-site-isolation/TestExpectations
M Source/WebCore/loader/NavigationRequester.cpp
M Source/WebCore/loader/NavigationRequester.h
M Source/WebCore/platform/network/NetworkStorageSession.cpp
M Source/WebCore/platform/network/NetworkStorageSession.h
M Source/WebKit/NetworkProcess/NetworkLoadParameters.h
M Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp
M Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.h
M
Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.serialization.in
M Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.h
M Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm
M Source/WebKit/NetworkProcess/cocoa/NetworkTaskCocoa.h
M Source/WebKit/NetworkProcess/cocoa/NetworkTaskCocoa.mm
M Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp
M Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.h
Log Message:
-----------
[Site Isolation] remove storage access on commit
https://bugs.webkit.org/show_bug.cgi?id=317934
rdar://180735236
Reviewed by Alex Christensen.
When a navigation of an iframe is initiated by a different, cross-site
frame, that iframe should lose its frame-specific storage access. This is
described by the navigation algorithm of the Storage Access API spec:
https://privacycg.github.io/storage-access/#navigation
WebKit implemented this for the same-process case in
WebLocalFrameLoaderClient::dispatchDecidePolicyForNavigationAction, but it
did not fire when the initiator and target frames were in different
processes under Site Isolation.
Rather than implement this check for the other frame is in another process
(WebRemoteFrameLoaderClient::dispatchDecidePolicyForNavigationAction),
this patch performs the storage access removal at commit time in
WebLocalFrameLoaderClient::dispatchDidCommitLoad. The committing frame is
always a local frame in its own process, where it owns
m_frameSpecificStorageAccessIdentifier and can remove access directly.
This way, the same code path covers both the same-process and cross-process
cases. The navigation initiator is available at commit via
DocumentLoader::triggeringAction()'s
requester, which is carried into the target process on the load.
Evaluating at commit time (instead of when a navigation is decided)
also means storage access is preserved while a navigation is in flight and
is not revoked at all for a navigation that never commits.
However, this doesn't cover a scenario where cookies should not be attached
to network requests that are made before the navigation load commits.
For example, if an iframe is navigated by a cross-site initiator it should
lose storage access. However, if you revoke the iframe's storage access
too-late (at commit-time), then it's possible for the main-resource load of the
navigation
to have cookies attached when it shouldn't. To solve this issue,
I modified NetworkStorageSession::thirdPartyCookieBlockingDecisionForRequest
to not attach cookies on network requests when it had a navigation which
certainly drops storage access.
This patch fixes
http/tests/storageAccess/request-and-grant-access-cross-origin-sandboxed-iframe-from-prevalent-domain-with-user-interaction-and-access-from-right-frame.https.html
and
imported/w3c/web-platform-tests/storage-access-api/requestStorageAccess-cross-origin-iframe-navigation.sub.https.window.html
with site isolation enabled.
* Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp:
(WebKit::WebLocalFrameLoaderClient::dispatchDidCommitLoad):
Remove storage access when navigation commits.
(WebKit::WebLocalFrameLoaderClient::removeStorageAccessOnCommit):
(WebKit::WebLocalFrameLoaderClient::dispatchDecidePolicyForNavigationAction):
Helper which performs the removal if the navigation meets
the requirements.
*
LayoutTests/http/tests/storageAccess/revoke-storage-access-deferred-until-failed-navigation.https.html:
Added.
Test that storage access is not revoked when a navigation fails to
commit.
*
LayoutTests/http/tests/storageAccess/revoke-storage-access-deferred-until-slow-navigation.https.html:
Added.
Test that storage access is not revoked when a navigation is still
in-flight (in this test, the navigation never commits which is
observably the same)
HTML of iframe which requests storage access and reports if it still
has it.
*
LayoutTests/http/tests/storageAccess/resources/deferred-storage-access-revocation-test.js:
Added.
(activateElement):
(relayMessage):
(receiveMessage):
(async runTest.switch.iframeElement.onload):
(async runTest):
Shared driver for the two tests above. Each test only sets the navigation
target and its description. The non-committing / in-flight navigation
targets
reuse the existing navigation/resources/response204.pl and never-respond.py.
*
LayoutTests/http/tests/storageAccess/resources/request-storage-access-and-report-client-side-cookies-iframe.html:
Added.
*
LayoutTests/http/tests/storageAccess/revoke-storage-access-deferred-until-failed-navigation.https-expected.txt:
Added.
*
LayoutTests/http/tests/storageAccess/revoke-storage-access-deferred-until-slow-navigation.https-expected.txt:
Added.
* Source/WebCore/loader/NavigationRequester.cpp:
(WebCore::shouldNavigationLoseFrameSpecificStorageAccess):
Helper which makes the policy decision on removing storage access
depending on if the navigation met the criteria from the Storage Access API
* Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:
(WebKit::WebLoaderStrategy::scheduleLoadFromNetworkProcess):
Populate new field in loadParameters to track if a navigation should
cause a frame to lose storage access.
* LayoutTests/ipc/loadping-firstpartyforcookies-message-check.html:
* LayoutTests/platform/ios-site-isolation/TestExpectations:
* LayoutTests/platform/mac-site-isolation/TestExpectations:
* Source/WebCore/loader/NavigationRequester.h:
* Source/WebCore/platform/network/NetworkStorageSession.cpp:
(WebCore::NetworkStorageSession::thirdPartyCookieBlockingDecisionForRequest
const):
* Source/WebCore/platform/network/NetworkStorageSession.h:
* Source/WebKit/NetworkProcess/NetworkLoadParameters.h:
* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp:
(WebKit::NetworkResourceLoadParameters::networkLoadParameters const):
* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.h:
* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.serialization.in:
* Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.h:
* Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:
(WebKit::NetworkDataTaskCocoa::NetworkDataTaskCocoa):
* Source/WebKit/NetworkProcess/cocoa/NetworkTaskCocoa.h:
(WebKit::NetworkTaskCocoa::navigationLosesFrameSpecificStorageAccess const):
* Source/WebKit/NetworkProcess/cocoa/NetworkTaskCocoa.mm:
(WebKit::NetworkTaskCocoa::requestThirdPartyCookieBlockingDecision const):
* Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.h:
Canonical link: https://commits.webkit.org/317642@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
