Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6164d9c66ecdd2da2fc3e3d65a657f58be5ddcd1
https://github.com/WebKit/WebKit/commit/6164d9c66ecdd2da2fc3e3d65a657f58be5ddcd1
Author: Anne van Kesteren <[email protected]>
Date: 2026-10-05 (Mon, 05 Oct 2026)
Changed paths:
M LayoutTests/TestExpectations
A
LayoutTests/imported/w3c/web-platform-tests/html/document-isolation-policy/isolate-and-require-corp-load-from-cache-storage.tentative.https-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/document-isolation-policy/isolate-and-require-corp.tentative.https-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/document-isolation-policy/no-secure-context.tentative-expected.txt
M LayoutTests/ipc/blob-registry-null-url-crash.html
M
LayoutTests/ipc/scheduleresourceload-resume-bind-to-claimant-message-check.html
M LayoutTests/platform/ios-site-isolation/TestExpectations
M LayoutTests/platform/mac-site-isolation/TestExpectations
M Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml
M Source/WebCore/Headers.cmake
M Source/WebCore/Modules/cache/DOMCache.cpp
M Source/WebCore/Modules/cache/RetrieveRecordsOptions.h
M Source/WebCore/Sources.txt
M Source/WebCore/WebCore.xcodeproj/project.pbxproj
M Source/WebCore/dom/Document.cpp
M Source/WebCore/dom/SecurityContext.cpp
M Source/WebCore/dom/SecurityContext.h
M Source/WebCore/loader/CrossOriginAccessControl.cpp
M Source/WebCore/loader/CrossOriginAccessControl.h
A Source/WebCore/loader/DocumentIsolationPolicy.cpp
A Source/WebCore/loader/DocumentIsolationPolicy.h
M Source/WebCore/loader/DocumentWriter.cpp
M Source/WebCore/loader/FrameLoader.cpp
M Source/WebCore/loader/PolicyContainer.cpp
M Source/WebCore/loader/PolicyContainer.h
M Source/WebCore/loader/cache/CachedResourceLoader.cpp
M Source/WebCore/platform/network/HTTPHeaderNames.in
M
Source/WebCore/workers/service/background-fetch/BackgroundFetchRegistration.cpp
M Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp
M Source/WebKit/NetworkProcess/NetworkLoadChecker.h
M Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.h
M
Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.serialization.in
M Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
M Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.cpp
M Source/WebKit/NetworkProcess/storage/CacheStorageCache.cpp
M Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in
M Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp
Log Message:
-----------
Add Document-Isolation-Policy infrastructure
https://bugs.webkit.org/show_bug.cgi?id=326321
rdar://189165672
Reviewed by Alex Christensen.
As a first step, parse the header and apply the subresource checks of
isolate-and-require-corp, behind the testable DocumentIsolationPolicyEnabled
preference. It is only honored when site isolation is enabled, as
Document-Isolation-Policy relies on it to give documents with the policy
their own process.
The policy is only honored in secure contexts. It is stored in the policy
container, so it is inherited by initial about:blank, about:srcdoc, data:,
javascript: and blob: documents, and restored from history.
isolate-and-require-corp requires cross-origin no-cors responses to have a
Cross-Origin-Resource-Policy header, just like COEP require-corp. It is
enforced for network loads, memory cache hits, responses from service
workers, and the Cache API. Navigations are not affected, so a document with
this policy can still embed cross-origin iframes without CORP.
Dedicated workers load through their owner document and therefore get its
policy. Shared and service workers do not get a policy.
isolate-and-credentialless, Document-Isolation-Policy-Report-Only, and
violation reports are not supported yet. Neither is the agent cluster
keying and cross-origin isolation that the policy also enables.
Canonical link: https://commits.webkit.org/322736@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
