Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d0aabe7a8b228b18ad5b8e2005e705e9db2302ca
https://github.com/WebKit/WebKit/commit/d0aabe7a8b228b18ad5b8e2005e705e9db2302ca
Author: Anne van Kesteren <[email protected]>
Date: 2026-10-06 (Tue, 06 Oct 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/no-secure-context-https-iframe-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/no-secure-context-https-iframe.html
M
LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/w3c-import.log
A
LayoutTests/imported/w3c/web-platform-tests/html/document-isolation-policy/no-secure-context-https-iframe.tentative-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/html/document-isolation-policy/no-secure-context-https-iframe.tentative.html
M
LayoutTests/imported/w3c/web-platform-tests/html/document-isolation-policy/w3c-import.log
M LayoutTests/platform/ios-site-isolation/TestExpectations
M LayoutTests/platform/mac-site-isolation/TestExpectations
M Source/WebCore/Headers.cmake
M Source/WebCore/WebCore.xcodeproj/project.pbxproj
M Source/WebCore/dom/Document.cpp
A Source/WebCore/dom/IsSecureContext.h
M Source/WebCore/loader/CrossOriginEmbedderPolicy.cpp
M Source/WebCore/loader/CrossOriginEmbedderPolicy.h
M Source/WebCore/loader/CrossOriginOpenerPolicy.cpp
M Source/WebCore/loader/DocumentIsolationPolicy.cpp
M Source/WebCore/loader/DocumentIsolationPolicy.h
M Source/WebCore/loader/FrameLoader.cpp
M Source/WebCore/loader/OriginAgentClusterPolicy.cpp
M Source/WebCore/loader/OriginAgentClusterPolicy.h
M Source/WebCore/workers/WorkerScriptLoader.cpp
M Source/WebCore/workers/WorkerScriptLoader.h
M Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
M
Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerSoftUpdateLoader.cpp
M Source/WebKit/UIProcess/WebPageProxy.cpp
Log Message:
-----------
Cross-Origin-Embedder-Policy should be ignored in non-secure contexts
https://bugs.webkit.org/show_bug.cgi?id=326351
rdar://189193030
Reviewed by Chris Dumez.
An embedder policy is only obtained for a secure context, but we only checked
the response URL, so an HTTPS document in an HTTP page, and the workers it
creates, still required CORP.
obtainCrossOriginEmbedderPolicy(), obtainDocumentIsolationPolicy() and
obtainOriginAgentClusterPolicy() now take whether the environment is a secure
context, rather than each determining it themselves. A document uses
Document::isSecureContext() and a worker uses its owner's.
With site isolation, Document::isSecureContext() is asked before a provisional
frame is added to the frame tree, so it now also checks the main frame when
there is no parent yet. Document-Isolation-Policy, which requires site
isolation, depends on this as well.
This is a first step towards determining once per navigation whether the
reserved environment is a secure context, as HTML does, so that
Document::isSecureContext() can stop walking the frame tree.
Tests:
imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/no-secure-context-https-iframe.html
imported/w3c/web-platform-tests/html/document-isolation-policy/no-secure-context-https-iframe.tentative.html
Canonical link: https://commits.webkit.org/322838@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
