Changeset 214778 in webkit


Ignore:
Timestamp:
Apr 3, 2017 5:39:18 AM (7 years ago)
Author:
Carlos Garcia Campos
Message:

Merge r214246 - [Soup] "Only from websites I visit" cookie policy is broken
​https://bugs.webkit.org/show_bug.cgi?id=168912

Reviewed by Carlos Garcia Campos.

Source/WebCore:

Do not reset the first party for cookies on redirects. That's properly done for the main
resource in DocumentLoader::willSendRequest and, in the case of subresources, is absolutely
wrong (which is what we were doing since r143931).

The most notable effect was that subresources loaded via redirects were effectively
bypassing the "no third party" policy for cookies.

Test: http/tests/security/cookies/third-party-cookie-blocking-redirect.html

  • platform/network/soup/ResourceHandleSoup.cpp:

(WebCore::doRedirect):

Source/WebKit2:

Do not reset the first party for cookies on redirects. That's properly done for the main
resource in DocumentLoader::willSendRequest and, in the case of subresources, is absolutely
wrong (which is what we were doing since r143931).

The most notable effect was that subresources loaded via redirects were effectively
bypassing the "no third party" policy for cookies.

  • NetworkProcess/soup/NetworkDataTaskSoup.cpp:

(WebKit::NetworkDataTaskSoup::continueHTTPRedirection):

LayoutTests:

  • http/tests/security/cookies/third-party-cookie-blocking-redirect-expected.txt: Added.
  • http/tests/security/cookies/third-party-cookie-blocking-redirect.html: Added.
Location:
releases/WebKitGTK/webkit-2.16
Files:
2 added
5 edited

Legend:

Unmodified
Added
Removed

  • releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog

    r214776 r214778  
     12017-03-21  Sergio Villar Senin  <svillar@igalia.com>
     2
     3        [Soup] "Only from websites I visit" cookie policy is broken
     4        https://bugs.webkit.org/show_bug.cgi?id=168912
     5
     6        Reviewed by Carlos Garcia Campos.
     7
     8        * http/tests/security/cookies/third-party-cookie-blocking-redirect-expected.txt: Added.
     9        * http/tests/security/cookies/third-party-cookie-blocking-redirect.html: Added.
     10
    1112017-03-21  Brady Eidson  <beidson@apple.com>
    212

  • releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog

    r214776 r214778  
     12017-03-21  Sergio Villar Senin  <svillar@igalia.com>
     2
     3        [Soup] "Only from websites I visit" cookie policy is broken
     4        https://bugs.webkit.org/show_bug.cgi?id=168912
     5
     6        Reviewed by Carlos Garcia Campos.
     7
     8        Do not reset the first party for cookies on redirects. That's properly done for the main
     9        resource in DocumentLoader::willSendRequest and, in the case of subresources, is absolutely
     10        wrong (which is what we were doing since r143931).
     11
     12        The most notable effect was that subresources loaded via redirects were effectively
     13        bypassing the "no third party" policy for cookies.
     14
     15        Test: http/tests/security/cookies/third-party-cookie-blocking-redirect.html
     16
     17        * platform/network/soup/ResourceHandleSoup.cpp:
     18        (WebCore::doRedirect):
     19
    1202017-03-21  Brady Eidson  <beidson@apple.com>
    221

  • releases/WebKitGTK/webkit-2.16/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp

    r211946 r214778  
    326326    bool crossOrigin = !protocolHostAndPortAreEqual(handle->firstRequest().url(), newURL);
    327327    newRequest.setURL(newURL);
    328     newRequest.setFirstPartyForCookies(newURL);
    329328
    330329    if (newRequest.httpMethod() != "GET") {

  • releases/WebKitGTK/webkit-2.16/Source/WebKit2/ChangeLog

    r214748 r214778  
     12017-03-21  Sergio Villar Senin  <svillar@igalia.com>
     2
     3        [Soup] "Only from websites I visit" cookie policy is broken
     4        https://bugs.webkit.org/show_bug.cgi?id=168912
     5
     6        Reviewed by Carlos Garcia Campos.
     7
     8        Do not reset the first party for cookies on redirects. That's properly done for the main
     9        resource in DocumentLoader::willSendRequest and, in the case of subresources, is absolutely
     10        wrong (which is what we were doing since r143931).
     11
     12        The most notable effect was that subresources loaded via redirects were effectively
     13        bypassing the "no third party" policy for cookies.
     14
     15        * NetworkProcess/soup/NetworkDataTaskSoup.cpp:
     16        (WebKit::NetworkDataTaskSoup::continueHTTPRedirection):
     17
    1182017-03-15  Tim Horton  <timothy_horton@apple.com>
    219

  • releases/WebKitGTK/webkit-2.16/Source/WebKit2/NetworkProcess/soup/NetworkDataTaskSoup.cpp

    r212286 r214778  
    616616    ResourceRequest request = m_firstRequest;
    617617    request.setURL(URL(m_response.url(), m_response.httpHeaderField(HTTPHeaderName::Location)));
    618     request.setFirstPartyForCookies(request.url());
    619618
    620619    // Should not set Referer after a redirect from a secure resource to non-secure one.
Note: See TracChangeset for help on using the changeset viewer.