Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f76f30efcb689ec60174addc19d38b9150b67c69
https://github.com/WebKit/WebKit/commit/f76f30efcb689ec60174addc19d38b9150b67c69
Author: Yury Semikhatsky <[email protected]>
Date: 2026-08-18 (Tue, 18 Aug 2026)
Changed paths:
M Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp
M Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestAuthentication.cpp
Log Message:
-----------
[SOUP] An Authorization header set by the page is replaced by cached
credentials
https://bugs.webkit.org/show_bug.cgi?id=322068
Reviewed by Michael Catanzaro.
nce an authentication challenge has been answered for a host, libsoup's
SoupAuthManager stamps the cached credentials onto every later request in that
protection space, replacing an Authorization header the page had set itself.
The Fetch standard uses the cached credential only "If httpRequest's header
list does not contain `Authorization`", and the Cocoa and curl ports already
behave that way.
Set SOUP_MESSAGE_DO_NOT_USE_AUTH_CACHE, libsoup's per-message opt-out, when the
request already carries an Authorization header. A challenge still reaches the
authentication handler and the retry authenticates as before.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestAuthentication.cpp
* Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp:
(WebKit::NetworkDataTaskSoup::createRequest):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestAuthentication.cpp:
(testWebViewAuthenticationPageProvidedAuthorizationHeader):
(serverCallback):
(beforeAll):
Canonical link: https://commits.webkit.org/319424@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
