Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c52bbb5187e1602b26568547b57440f196bba56a
https://github.com/WebKit/WebKit/commit/c52bbb5187e1602b26568547b57440f196bba56a
Author: Matthew Finkel <[email protected]>
Date: 2026-08-21 (Fri, 21 Aug 2026)
Changed paths:
A
LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe-expected.txt
A
LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe.html
A
LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe-expected.txt
A
LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe.html
A LayoutTests/http/tests/cookies/same-site/resources/record-image-cookies.py
A
LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-img-inside-cross-origin-iframe.html
A
LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-inside-cross-origin-iframe.html
M Source/WebCore/loader/FrameLoader.cpp
Log Message:
-----------
Srcdoc iframes bypass SameSite Strict and Lax cookies
https://bugs.webkit.org/show_bug.cgi?id=313220
rdar://175498842
Reviewed by Charlie Wolfe.
When we set firstPartyForCookies on a subframe, we check if either:
1) shouldInheritSecurityOriginFromOwner is true for the current document's URL,
or
2) if the current document's URL is same-registrable-domain as the top-level
document URL
In the case of an iframe with srcdoc, shouldInheritSecurityOriginFromOwner
returns true (as documented), and this causes us to set the page's mainFrameURL
as the firstPartyForCookies. We need a conditional exception for
shouldInheritSecurityOriginFromOwner, but it should take nested iframes into
account. This patch adjusts the logic so we inherit the ancestor frame's
siteForCookies instead of the page's URL. The same-registrable-domain check
remains unchanged.
Test:
http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe.html
*
LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe.html:
Added.
*
LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe-expected.txt:
Added.
*
LayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe.html:
Added.
* LayoutTests/http/tests/cookies/same-site/resources/record-image-cookies.py:
Added.
*
LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-img-inside-cross-origin-iframe.html:
Added.
*
LayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-inside-cross-origin-iframe.html:
Added.
* Source/WebCore/loader/FrameLoader.cpp:
(WebCore::FrameLoader::setFirstPartyForCookies):
Originally-landed-as: [email protected] (edd74642a6ef).
rdar://184744188
Canonical link: https://commits.webkit.org/319605@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
