Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 6f79e4f3e9d4e3f3e476bdb140bf146500779b83
https://github.com/WebKit/WebKit/commit/6f79e4f3e9d4e3f3e476bdb140bf146500779b83
Author: Yury Semikhatsky <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
M Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp
M Tools/TestWebKitAPI/Tests/WebKitGLib/TestAuthentication.cpp
Log Message:
-----------
Cherry-pick 319424@main (f76f30efcb68).
https://bugs.webkit.org/show_bug.cgi?id=322068
[SOUP] An Authorization header set by the page is replaced by cached
credentials
https://bugs.webkit.org/show_bug.cgi?id=322068
Reviewed by Michael Catanzaro.
nce an authentication challenge has been answered for a host, libsoup's
SoupAuthManager stamps the cached credentials onto every later request in
that
protection space, replacing an Authorization header the page had set itself.
The Fetch standard uses the cached credential only "If httpRequest's header
list does not contain `Authorization`", and the Cocoa and curl ports already
behave that way.
Set SOUP_MESSAGE_DO_NOT_USE_AUTH_CACHE, libsoup's per-message opt-out, when
the
request already carries an Authorization header. A challenge still reaches
the
authentication handler and the retry authenticates as before.
Test: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestAuthentication.cpp
* Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp:
(WebKit::NetworkDataTaskSoup::createRequest):
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestAuthentication.cpp:
(testWebViewAuthenticationPageProvidedAuthorizationHeader):
(serverCallback):
(beforeAll):
Canonical link: https://commits.webkit.org/319424@main
Canonical link: https://commits.webkit.org/305877.1105@webkitglib/2.52
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
