Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7d09127ca947791dc0a72109466a9b0433ab898e
https://github.com/WebKit/WebKit/commit/7d09127ca947791dc0a72109466a9b0433ab898e
Author: Zak Ridouh <[email protected]>
Date: 2026-08-18 (Tue, 18 Aug 2026)
Changed paths:
M Source/WebCore/loader/CookieJar.cpp
M Source/WebCore/loader/CookieJar.h
M Source/WebCore/platform/network/CacheValidation.cpp
M Source/WebCore/platform/network/CacheValidation.h
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in
M Source/WebKit/NetworkProcess/NetworkProcess.h
M Source/WebKit/Scripts/webkit/messages.py
M Source/WebKit/Scripts/webkit/opaque_ipc_types.tracking.in
M Source/WebKit/WebProcess/WebPage/WebCookieJar.cpp
M Source/WebKit/WebProcess/WebPage/WebCookieJar.h
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/IPCTestingAPI.mm
Log Message:
-----------
Return a digest instead of the Cookie header for Vary: Cookie validation
https://bugs.webkit.org/show_bug.cgi?id=321579
rdar://184690236
Reviewed by Charlie Wolfe.
CookieRequestHeaderFieldValue returned the full Cookie header to a web process,
HttpOnly cookies included. A web process must never see an HttpOnly value. The
message also validated only firstParty, which does not constrain the url the
cookies are read for.
Its only caller is Vary: Cookie cache validation, which compares the value and
never reads it. Return a SHA-1 digest instead, as a std::array<uint8_t, 20> with
std::nullopt for "no Cookie header". The digest is salted per network process
launch, so a web process cannot recover the header by hashing candidates.
collectVaryingRequestHeaders() stores its values in a Vector<std::pair<String,
String>> that the network cache writes to disk, so the digest is base64 encoded
at that boundary.
std::array<uint8_t, N> is an opaque IPC data type, so the reply parameter needs
an entry in opaque_ipc_types.tracking.in. messages.py did not know a header for
std::array yet.
Dropping frameID, pageID and webPageProxyID preserves behavior, because that
caller always passed std::nullopt for the first two and
shouldRelaxThirdPartyCookieBlockingForPage() already returned No.
Existing cache entries hold a raw header, so Vary: Cookie entries revalidate
once. The cache version stays the same on purpose, because a bump would discard
every cached resource instead of only those.
WebCookieJar::cookieRequestHeaderFieldValue now returns nothing. Its only
WebKit2
caller is Web Inspector WebSocket handshake reporting, and both channels discard
it. WebKitLegacy uses the unchanged base class implementation.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/IPCTestingAPI.mm
* Source/WebCore/loader/CookieJar.cpp:
(WebCore::CookieJar::cookieRequestHeaderFieldValueDigest const):
* Source/WebCore/loader/CookieJar.h:
* Source/WebCore/platform/network/CacheValidation.cpp:
(WebCore::computeCookieHeaderDigestForVary):
(WebCore::encodeCookieHeaderDigestForVary):
(WebCore::cookieRequestHeaderFieldValueForVary):
(WebCore::collectVaryingRequestHeaders):
(WebCore::verifyVaryingRequestHeaders):
(WebCore::cookieRequestHeaderFieldValue): Deleted.
* Source/WebCore/platform/network/CacheValidation.h:
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::cookieRequestHeaderFieldValueDigest):
(WebKit::NetworkConnectionToWebProcess::cookieRequestHeaderFieldValue): Deleted.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h:
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in:
* Source/WebKit/NetworkProcess/NetworkProcess.h:
* Source/WebKit/Scripts/webkit/messages.py:
* Source/WebKit/Scripts/webkit/opaque_ipc_types.tracking.in:
* Source/WebKit/WebProcess/WebPage/WebCookieJar.cpp:
(WebKit::WebCookieJar::cookieRequestHeaderFieldValue const):
(WebKit::WebCookieJar::cookieRequestHeaderFieldValueDigest const):
* Source/WebKit/WebProcess/WebPage/WebCookieJar.h:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/IPCTestingAPI.mm:
(EmptyFirstPartyForCookiesCookieRequestHeaderFieldValueDigest)):
(InvalidSameSiteInfoCookieRequestHeaderFieldValueDigest)):
(EmptyFirstPartyForCookiesCookieRequestHeaderFieldValue)): Deleted.
(InvalidSameSiteInfoCookieRequestHeaderFieldValue)): Deleted.
Canonical link: https://commits.webkit.org/319397@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
