Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 86e957015e02f6e737e1f7c6d5217499ff36ab2f
https://github.com/WebKit/WebKit/commit/86e957015e02f6e737e1f7c6d5217499ff36ab2f
Author: Pascoe <[email protected]>
Date: 2026-08-27 (Thu, 27 Aug 2026)
Changed paths:
M Source/WebCore/Headers.cmake
A Source/WebCore/Modules/webauthn/WellKnownOriginList.cpp
A Source/WebCore/Modules/webauthn/WellKnownOriginList.h
M Source/WebCore/Sources.txt
M Source/WebCore/WebCore.xcodeproj/project.pbxproj
M Source/WebKit/Sources.txt
M Source/WebKit/UIProcess/API/APIUIClient.h
M Source/WebKit/UIProcess/API/Cocoa/WKUIDelegatePrivate.h
M Source/WebKit/UIProcess/Cocoa/UIDelegate.h
M Source/WebKit/UIProcess/Cocoa/UIDelegate.mm
M
Source/WebKit/UIProcess/WebAuthentication/Cocoa/WebAuthenticatorCoordinatorProxy.mm
A Source/WebKit/UIProcess/WebAuthentication/RelatedOriginsValidator.cpp
A Source/WebKit/UIProcess/WebAuthentication/RelatedOriginsValidator.h
M
Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.cpp
M
Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.h
A Source/WebKit/UIProcess/WellKnownResourceFetcher.cpp
A Source/WebKit/UIProcess/WellKnownResourceFetcher.h
M Source/WebKit/WebKit.xcodeproj/project.pbxproj
M Tools/Scripts/webkitpy/api_tests/allowlist.txt
M Tools/TestWebKitAPI/CMakeLists.txt
M Tools/TestWebKitAPI/Helpers/cocoa/HTTPServer.h
M Tools/TestWebKitAPI/Helpers/cocoa/HTTPServer.mm
M Tools/TestWebKitAPI/SourcesCocoa.txt
M Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
A Tools/TestWebKitAPI/Tests/WebCore/WellKnownOriginList.cpp
A Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebAuthnRelatedOriginsFetch.mm
Log Message:
-----------
[WebAuthn] Perform validation of related origins
https://bugs.webkit.org/show_bug.cgi?id=321380
rdar://problem/184430447
Reviewed by Abrar Rahman Protyasha.
Validate related origins in WebKit by fetching the RP's well-known resource on
the page's
network session.
The rules live in WebCore as WellKnownOriginList, which takes the endpoint path
and JSON
member name as arguments so that another feature can reuse them. The fetch is
WellKnownResourceFetcher, bounded in both directions since the host is page
controlled.
33 unit tests cover the parsing and matching logic (label limits, malformed
JSON, scheme
validation, redirect policy). 15 API tests cover the fetch lifecycle including
timeout,
size limits, redirects, MIME enforcement, and the delegate receiving validated
origins.
* Source/WebCore/Headers.cmake:
* Source/WebCore/Modules/webauthn/WellKnownOriginList.cpp: Added.
(WebCore::wellKnownURL):
(WebCore::isWellKnownResponseAcceptable):
(WebCore::isWellKnownRedirectAllowed):
(WebCore::findOriginInWellKnownList):
(WebCore::parseOriginsFromWellKnownList):
* Source/WebCore/Modules/webauthn/WellKnownOriginList.h: Added.
* Source/WebCore/Sources.txt:
* Source/WebCore/WebCore.xcodeproj/project.pbxproj:
* Source/WebKit/Sources.txt:
* Source/WebKit/UIProcess/API/APIUIClient.h:
* Source/WebKit/UIProcess/API/Cocoa/WKUIDelegatePrivate.h:
* Source/WebKit/UIProcess/Cocoa/UIDelegate.h:
* Source/WebKit/UIProcess/Cocoa/UIDelegate.mm:
*
Source/WebKit/UIProcess/WebAuthentication/Cocoa/WebAuthenticatorCoordinatorProxy.mm:
(WebKit::WebAuthenticatorCoordinatorProxy::performRequest):
(WebKit::WebAuthenticatorCoordinatorProxy::performRequestWithValidatedRelyingPartyIdentifier):
* Source/WebKit/UIProcess/WebAuthentication/RelatedOriginsValidator.cpp: Added.
(WebKit::RelatedOriginsValidation::validate):
* Source/WebKit/UIProcess/WebAuthentication/RelatedOriginsValidator.h: Added.
*
Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.cpp:
(WebKit::WebAuthenticatorCoordinatorProxy::handleRequest):
* Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.h:
* Source/WebKit/UIProcess/WellKnownResourceFetcher.cpp: Added.
(WebKit::WellKnownResourceFetcher::fetch):
* Source/WebKit/UIProcess/WellKnownResourceFetcher.h: Added.
* Source/WebKit/WebKit.xcodeproj/project.pbxproj:
* Tools/Scripts/webkitpy/api_tests/allowlist.txt:
* Tools/TestWebKitAPI/CMakeLists.txt:
* Tools/TestWebKitAPI/SourcesCocoa.txt:
* Tools/TestWebKitAPI/Tests/WebCore/WellKnownOriginList.cpp: Added.
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebAuthnRelatedOriginsFetch.mm:
Added.
* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
Canonical link: https://commits.webkit.org/319973@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
