⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 259275 in webkit


Ignore:
Timestamp:
Mar 30, 2020, 7:45:38 PM (6 years ago)
Author:
wilander@apple.com
Message:

Experimental: Enforce SameSite=strict for domains classified as bounce trackers
​https://bugs.webkit.org/show_bug.cgi?id=209761
<rdar://problem/59394943>

Reviewed by Brent Fulgham and Kate Cheney (informal).

Source/WebCore:

This experimental feature is part of Intelligent Tracking Prevention and only enabled if
ITP (Resource Load Statistics) are. A new enum WebCore::SameSiteStrictEnforcementEnabled
controls the new behavior with default setting WebCore::SameSiteStrictEnforcementEnabled::No.

The features keeps a separate count of topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement
which builds up to a threshold. Once a domain goes above the threshold, its cookies are
rewritten as SameSite=strict and the topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement
counter for that domain is reset, effectively giving the domain a new chance to change its
behavior.

Tests: http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to-database.html

http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to.html

  • loader/ResourceLoadStatistics.h:

New field topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement.

  • page/Settings.yaml:
  • platform/network/NetworkStorageSession.h:

New enum SameSiteStrictEnforcementEnabled.

Source/WebKit:

This experimental feature is part of Intelligent Tracking Prevention and only enabled if
ITP (Resource Load Statistics) are. A new enum WebCore::SameSiteStrictEnforcementEnabled
controls the new behavior with default setting WebCore::SameSiteStrictEnforcementEnabled::No.

The features keeps a separate count of topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement
which builds up to a threshold. Once a domain goes above the threshold, its cookies are
rewritten as SameSite=strict and the topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement
counter for that domain is reset, effectively giving the domain a new chance to change its
behavior.

Test infrastructure is added to allow for layout tests.

  • NetworkProcess/Classifier/ResourceLoadStatisticsDatabaseStore.cpp:

(WebKit::ResourceLoadStatisticsDatabaseStore::createUniqueIndices):
(WebKit::ResourceLoadStatisticsDatabaseStore::createSchema):
(WebKit::ResourceLoadStatisticsDatabaseStore::insertDomainRelationships):
(WebKit::CompletionHandler<void):

  • NetworkProcess/Classifier/ResourceLoadStatisticsDatabaseStore.h:
  • NetworkProcess/Classifier/ResourceLoadStatisticsMemoryStore.cpp:

(WebKit::ResourceLoadStatisticsMemoryStore::logFrameNavigation):
(WebKit::ResourceLoadStatisticsMemoryStore::setTopFrameUniqueRedirectTo):
(WebKit::ResourceLoadStatisticsMemoryStore::shouldEnforceSameSiteStrictFor):
(WebKit::ResourceLoadStatisticsMemoryStore::registrableDomainsToDeleteOrRestrictWebsiteDataFor):

  • NetworkProcess/Classifier/ResourceLoadStatisticsMemoryStore.h:
  • NetworkProcess/Classifier/ResourceLoadStatisticsStore.h:

(WebKit::ResourceLoadStatisticsStore::setSameSiteStrictEnforcementEnabled):
(WebKit::ResourceLoadStatisticsStore::isSameSiteStrictEnforcementEnabled const):

  • NetworkProcess/Classifier/WebResourceLoadStatisticsStore.cpp:

(WebKit::WebResourceLoadStatisticsStore::setSameSiteStrictEnforcementEnabled):

  • NetworkProcess/Classifier/WebResourceLoadStatisticsStore.h:

(WebKit::RegistrableDomainsToDeleteOrRestrictWebsiteDataFor::isolatedCopy const):
(WebKit::RegistrableDomainsToDeleteOrRestrictWebsiteDataFor::isEmpty const):

  • NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::setShouldEnbleSameSiteStrictEnforcementForTesting):

  • NetworkProcess/NetworkProcess.h:
  • NetworkProcess/NetworkProcess.messages.in:

Added SetShouldEnbleSameSiteStrictEnforcementForTesting.

  • NetworkProcess/NetworkSession.cpp:

(WebKit::NetworkSession::NetworkSession):
(WebKit::NetworkSession::forwardResourceLoadStatisticsSettings):
(WebKit::NetworkSession::deleteAndRestrictWebsiteDataForRegistrableDomains):
(WebKit::NetworkSession::setShouldEnbleSameSiteStrictEnforcement):

  • NetworkProcess/NetworkSession.h:
  • Scripts/webkit/messages.py:

IPC instructions to find WebCore::SameSiteStrictEnforcementEnabled in
WebCore/NetworkStorageSession.h.

  • Shared/ResourceLoadStatisticsParameters.h:

(WebKit::ResourceLoadStatisticsParameters::encode const):
(WebKit::ResourceLoadStatisticsParameters::decode):

  • Shared/WebPreferences.yaml:
  • UIProcess/API/APINavigation.h:

(API::Navigation::setIsLoadedWithNavigationShared):
(API::Navigation::isLoadedWithNavigationShared const):

Keeps track of how a navigation occurs to make sure that
WebPageProxy::logFrameNavigation() can capture navigations initiated by the
user through the hosting application.

  • UIProcess/API/C/WKWebsiteDataStoreRef.cpp:

(WKWebsiteDataStoreStatisticsResetToConsistentState):

  • UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::setShouldEnbleSameSiteStrictEnforcementForTesting):

  • UIProcess/Network/NetworkProcessProxy.h:
  • UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::loadRequestWithNavigationShared):

See comment above for API::Navigation.

(WebKit::WebPageProxy::decidePolicyForNavigationAction):

See comment above for API::Navigation.

  • UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::ensureNetworkProcess):

  • UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm:

(WebKit::WebsiteDataStore::parameters):

  • UIProcess/WebsiteData/WebsiteDataStore.cpp:

(WebKit::WebsiteDataStore::setResourceLoadStatisticsShouldEnbleSameSiteStrictEnforcementForTesting):

  • UIProcess/WebsiteData/WebsiteDataStore.h:

LayoutTests:

  • http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to-database-expected.txt: Added.
  • http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to-database.html: Added.
  • http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to-expected.txt: Added.
  • http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to.html: Added.
  • platform/ios/TestExpectations:

New test cases marked as pass for Catalina+ based on CFNetwork API availability.

  • platform/mac-wk2/TestExpectations:

New test cases marked as pass for Catalina+ based on CFNetwork API availability.

  • platform/wk2/TestExpectations:

New test cases marked as skip due to CFNetwork API availability.

Location:
trunk
Files:
4 added
33 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r259262 r259275  
     12020-03-30  John Wilander  <wilander@apple.com>
     2
     3        Experimental: Enforce SameSite=strict for domains classified as bounce trackers
     4        https://bugs.webkit.org/show_bug.cgi?id=209761
     5        <rdar://problem/59394943>
     6
     7        Reviewed by Brent Fulgham and Kate Cheney (informal).
     8
     9        * http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to-database-expected.txt: Added.
     10        * http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to-database.html: Added.
     11        * http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to-expected.txt: Added.
     12        * http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to.html: Added.
     13        * platform/ios/TestExpectations:
     14            New test cases marked as pass for Catalina+ based on CFNetwork API availability.
     15        * platform/mac-wk2/TestExpectations:
     16            New test cases marked as pass for Catalina+ based on CFNetwork API availability.
     17        * platform/wk2/TestExpectations:
     18            New test cases marked as skip due to CFNetwork API availability.
     19
    1202020-03-30  Alexey Shvayka  <shvaikalesh@gmail.com>
    221

  • trunk/LayoutTests/platform/ios/TestExpectations

    r259195 r259275  
    27452745# The SameSite cookie API is only available in macOS Catalina and above, and thus skipped for WK2 in general.
    27462746http/tests/resourceLoadStatistics/set-all-cookies-to-same-site-strict.html [ Pass ]
     2747http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to.html [ Pass ]
     2748http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to-database.html [ Pass ]
    27472749
    27482750http/tests/storageAccess/deny-storage-access-under-opener.html [ Pass ]

  • trunk/LayoutTests/platform/mac-wk2/TestExpectations

    r259261 r259275  
    714714# The SameSite cookie API is only available in macOS Catalina and above.
    715715[ Catalina+ ] http/tests/resourceLoadStatistics/set-all-cookies-to-same-site-strict.html [ Pass ]
     716[ Catalina+ ] http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to.html [ Pass ]
     717[ Catalina+ ] http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to-database.html [ Pass ]
    716718
    717719# Skipped in general expectations since they only work on iOS and Mac, WK2.

  • trunk/LayoutTests/platform/wk2/TestExpectations

    r258884 r259275  
    736736# The SameSite cookie API is only available in macOS Catalina and above.
    737737http/tests/resourceLoadStatistics/set-all-cookies-to-same-site-strict.html [ Skip ]
     738http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to.html [ Skip ]
     739http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to-database.html [ Skip ]
    738740
    739741http/tests/websocket/connection-refusal-in-frame-resource-load-statistics.html [ Pass ]

  • trunk/Source/WebCore/ChangeLog

    r259261 r259275  
     12020-03-30  John Wilander  <wilander@apple.com>
     2
     3        Experimental: Enforce SameSite=strict for domains classified as bounce trackers
     4        https://bugs.webkit.org/show_bug.cgi?id=209761
     5        <rdar://problem/59394943>
     6
     7        Reviewed by Brent Fulgham and Kate Cheney (informal).
     8
     9        This experimental feature is part of Intelligent Tracking Prevention and only enabled if
     10        ITP (Resource Load Statistics) are. A new enum WebCore::SameSiteStrictEnforcementEnabled
     11        controls the new behavior with default setting WebCore::SameSiteStrictEnforcementEnabled::No.
     12
     13        The features keeps a separate count of topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement
     14        which builds up to a threshold. Once a domain goes above the threshold, its cookies are
     15        rewritten as SameSite=strict and the topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement
     16        counter for that domain is reset, effectively giving the domain a new chance to change its
     17        behavior.
     18
     19        Tests: http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to-database.html
     20               http/tests/resourceLoadStatistics/enforce-samesite-strict-based-on-top-frame-unique-redirects-to.html
     21
     22        * loader/ResourceLoadStatistics.h:
     23            New field topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement.
     24        * page/Settings.yaml:
     25        * platform/network/NetworkStorageSession.h:
     26            New enum SameSiteStrictEnforcementEnabled.
     27
    1282020-03-30  Devin Rousso  <drousso@apple.com>
    229

  • trunk/Source/WebCore/loader/ResourceLoadStatistics.h

    r257726 r259275  
    8080    // Top frame stats
    8181    HashSet<RegistrableDomain> topFrameUniqueRedirectsTo;
     82    HashSet<RegistrableDomain> topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement;
    8283    HashSet<RegistrableDomain> topFrameUniqueRedirectsFrom;
    8384    HashSet<RegistrableDomain> topFrameLinkDecorationsFrom;

  • trunk/Source/WebCore/page/Settings.yaml

    r258482 r259275  
    911911  initial: false
    912912
     913isSameSiteStrictEnforcementEnabled:
     914  initial: false
     915
    913916isLoggedInAPIEnabled:
    914917  initial: false

  • trunk/Source/WebCore/platform/network/NetworkStorageSession.h

    r258884 r259275  
    7979enum class IncludeHttpOnlyCookies : bool;
    8080enum class ThirdPartyCookieBlockingMode : uint8_t { All, AllOnSitesWithoutUserInteraction, OnlyAccordingToPerDomainPolicy };
     81enum class SameSiteStrictEnforcementEnabled : bool { Yes, No };
    8182enum class FirstPartyWebsiteDataRemovalMode : uint8_t { AllButCookies, None, AllButCookiesLiveOnTestingTimeout, AllButCookiesReproTestingTimeout };
    8283enum class ShouldAskITP : bool { No, Yes };

  • trunk/Source/WebKit/ChangeLog

    r259253 r259275  
     12020-03-30  John Wilander  <wilander@apple.com>
     2
     3        Experimental: Enforce SameSite=strict for domains classified as bounce trackers
     4        https://bugs.webkit.org/show_bug.cgi?id=209761
     5        <rdar://problem/59394943>
     6
     7        Reviewed by Brent Fulgham and Kate Cheney (informal).
     8
     9        This experimental feature is part of Intelligent Tracking Prevention and only enabled if
     10        ITP (Resource Load Statistics) are. A new enum WebCore::SameSiteStrictEnforcementEnabled
     11        controls the new behavior with default setting WebCore::SameSiteStrictEnforcementEnabled::No.
     12
     13        The features keeps a separate count of topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement
     14        which builds up to a threshold. Once a domain goes above the threshold, its cookies are
     15        rewritten as SameSite=strict and the topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement
     16        counter for that domain is reset, effectively giving the domain a new chance to change its
     17        behavior.
     18
     19        Test infrastructure is added to allow for layout tests.
     20
     21        * NetworkProcess/Classifier/ResourceLoadStatisticsDatabaseStore.cpp:
     22        (WebKit::ResourceLoadStatisticsDatabaseStore::createUniqueIndices):
     23        (WebKit::ResourceLoadStatisticsDatabaseStore::createSchema):
     24        (WebKit::ResourceLoadStatisticsDatabaseStore::insertDomainRelationships):
     25        (WebKit::CompletionHandler<void):
     26        * NetworkProcess/Classifier/ResourceLoadStatisticsDatabaseStore.h:
     27        * NetworkProcess/Classifier/ResourceLoadStatisticsMemoryStore.cpp:
     28        (WebKit::ResourceLoadStatisticsMemoryStore::logFrameNavigation):
     29        (WebKit::ResourceLoadStatisticsMemoryStore::setTopFrameUniqueRedirectTo):
     30        (WebKit::ResourceLoadStatisticsMemoryStore::shouldEnforceSameSiteStrictFor):
     31        (WebKit::ResourceLoadStatisticsMemoryStore::registrableDomainsToDeleteOrRestrictWebsiteDataFor):
     32        * NetworkProcess/Classifier/ResourceLoadStatisticsMemoryStore.h:
     33        * NetworkProcess/Classifier/ResourceLoadStatisticsStore.h:
     34        (WebKit::ResourceLoadStatisticsStore::setSameSiteStrictEnforcementEnabled):
     35        (WebKit::ResourceLoadStatisticsStore::isSameSiteStrictEnforcementEnabled const):
     36        * NetworkProcess/Classifier/WebResourceLoadStatisticsStore.cpp:
     37        (WebKit::WebResourceLoadStatisticsStore::setSameSiteStrictEnforcementEnabled):
     38        * NetworkProcess/Classifier/WebResourceLoadStatisticsStore.h:
     39        (WebKit::RegistrableDomainsToDeleteOrRestrictWebsiteDataFor::isolatedCopy const):
     40        (WebKit::RegistrableDomainsToDeleteOrRestrictWebsiteDataFor::isEmpty const):
     41        * NetworkProcess/NetworkProcess.cpp:
     42        (WebKit::NetworkProcess::setShouldEnbleSameSiteStrictEnforcementForTesting):
     43        * NetworkProcess/NetworkProcess.h:
     44        * NetworkProcess/NetworkProcess.messages.in:
     45            Added SetShouldEnbleSameSiteStrictEnforcementForTesting.
     46        * NetworkProcess/NetworkSession.cpp:
     47        (WebKit::NetworkSession::NetworkSession):
     48        (WebKit::NetworkSession::forwardResourceLoadStatisticsSettings):
     49        (WebKit::NetworkSession::deleteAndRestrictWebsiteDataForRegistrableDomains):
     50        (WebKit::NetworkSession::setShouldEnbleSameSiteStrictEnforcement):
     51        * NetworkProcess/NetworkSession.h:
     52        * Scripts/webkit/messages.py:
     53            IPC instructions to find WebCore::SameSiteStrictEnforcementEnabled in
     54            WebCore/NetworkStorageSession.h.
     55        * Shared/ResourceLoadStatisticsParameters.h:
     56        (WebKit::ResourceLoadStatisticsParameters::encode const):
     57        (WebKit::ResourceLoadStatisticsParameters::decode):
     58        * Shared/WebPreferences.yaml:
     59        * UIProcess/API/APINavigation.h:
     60        (API::Navigation::setIsLoadedWithNavigationShared):
     61        (API::Navigation::isLoadedWithNavigationShared const):
     62            Keeps track of how a navigation occurs to make sure that
     63            WebPageProxy::logFrameNavigation() can capture navigations initiated by the
     64            user through the hosting application.
     65        * UIProcess/API/C/WKWebsiteDataStoreRef.cpp:
     66        (WKWebsiteDataStoreStatisticsResetToConsistentState):
     67        * UIProcess/Network/NetworkProcessProxy.cpp:
     68        (WebKit::NetworkProcessProxy::setShouldEnbleSameSiteStrictEnforcementForTesting):
     69        * UIProcess/Network/NetworkProcessProxy.h:
     70        * UIProcess/WebPageProxy.cpp:
     71        (WebKit::WebPageProxy::loadRequestWithNavigationShared):
     72            See comment above for API::Navigation.
     73        (WebKit::WebPageProxy::decidePolicyForNavigationAction):
     74            See comment above for API::Navigation.
     75        * UIProcess/WebProcessPool.cpp:
     76        (WebKit::WebProcessPool::ensureNetworkProcess):
     77        * UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm:
     78        (WebKit::WebsiteDataStore::parameters):
     79        * UIProcess/WebsiteData/WebsiteDataStore.cpp:
     80        (WebKit::WebsiteDataStore::setResourceLoadStatisticsShouldEnbleSameSiteStrictEnforcementForTesting):
     81        * UIProcess/WebsiteData/WebsiteDataStore.h:
     82
    1832020-03-30  Andres Gonzalez  <andresg_22@apple.com>
    284

  • trunk/Source/WebKit/NetworkProcess/Classifier/ResourceLoadStatisticsDatabaseStore.cpp

    r259236 r259275  
    8282constexpr auto storageAccessUnderTopFrameDomainsQuery = "INSERT OR IGNORE INTO StorageAccessUnderTopFrameDomains (domainID, topLevelDomainID) SELECT ?, domainID FROM ObservedDomains WHERE registrableDomain in ( "_s;
    8383constexpr auto topFrameUniqueRedirectsToQuery = "INSERT OR IGNORE into TopFrameUniqueRedirectsTo (sourceDomainID, toDomainID) SELECT ?, domainID FROM ObservedDomains where registrableDomain in ( "_s;
     84constexpr auto topFrameUniqueRedirectsToSinceSameSiteStrictEnforcementQuery = "INSERT OR IGNORE into TopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement (sourceDomainID, toDomainID) SELECT ?, domainID FROM ObservedDomains where registrableDomain in ( "_s;
    8485constexpr auto topFrameUniqueRedirectsFromQuery = "INSERT OR IGNORE INTO TopFrameUniqueRedirectsFrom (targetDomainID, fromDomainID) SELECT ?, domainID FROM ObservedDomains WHERE registrableDomain in ( "_s;
    8586constexpr auto topFrameLoadedThirdPartyScriptsQuery = "INSERT OR IGNORE into TopFrameLoadedThirdPartyScripts (topFrameDomainID, subresourceDomainID) SELECT ?, domainID FROM ObservedDomains where registrableDomain in ( "_s;
    … …  
    139140    "StorageAccessUnderTopFrameDomains",
    140141    "TopFrameUniqueRedirectsTo",
     142    "TopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement",
    141143    "TopFrameUniqueRedirectsFrom",
    142144    "TopFrameLinkDecorationsFrom",
    … …  
    184186    "FOREIGN KEY(sourceDomainID) REFERENCES TopLevelDomains(topLevelDomainID) ON DELETE CASCADE, "
    185187    "FOREIGN KEY(toDomainID) REFERENCES TopLevelDomains(topLevelDomainID) ON DELETE CASCADE);"_s;
    186    
     188
     189constexpr auto createTopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement = "CREATE TABLE TopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement ("
     190    "sourceDomainID INTEGER NOT NULL, toDomainID INTEGER NOT NULL, "
     191    "FOREIGN KEY(sourceDomainID) REFERENCES TopLevelDomains(topLevelDomainID) ON DELETE CASCADE, "
     192    "FOREIGN KEY(toDomainID) REFERENCES TopLevelDomains(topLevelDomainID) ON DELETE CASCADE);"_s;
     193
    187194constexpr auto createTopFrameUniqueRedirectsFrom = "CREATE TABLE TopFrameUniqueRedirectsFrom ("
    188195    "targetDomainID INTEGER NOT NULL, fromDomainID INTEGER NOT NULL, "
    … …  
    223230constexpr auto createUniqueIndexStorageAccessUnderTopFrameDomains = "CREATE UNIQUE INDEX IF NOT EXISTS StorageAccessUnderTopFrameDomains_domainID_topLevelDomainID on StorageAccessUnderTopFrameDomains ( domainID, topLevelDomainID );"_s;
    224231constexpr auto createUniqueIndexTopFrameUniqueRedirectsTo = "CREATE UNIQUE INDEX IF NOT EXISTS TopFrameUniqueRedirectsTo_sourceDomainID_toDomainID on TopFrameUniqueRedirectsTo ( sourceDomainID, toDomainID );"_s;
     232constexpr auto createUniqueIndexTopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement = "CREATE UNIQUE INDEX IF NOT EXISTS TopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement_sourceDomainID_toDomainID on TopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement ( sourceDomainID, toDomainID );"_s;
    225233constexpr auto createUniqueIndexTopFrameUniqueRedirectsFrom = "CREATE UNIQUE INDEX IF NOT EXISTS TopFrameUniqueRedirectsFrom_targetDomainID_fromDomainID on TopFrameUniqueRedirectsFrom ( targetDomainID, fromDomainID );"_s;
    226234constexpr auto createUniqueIndexTopFrameLinkDecorationsFrom = "CREATE UNIQUE INDEX IF NOT EXISTS TopFrameLinkDecorationsFrom_toDomainID_fromDomainID on TopFrameLinkDecorationsFrom ( toDomainID, fromDomainID );"_s;
    … …  
    413421    if (!m_database.executeCommand(createUniqueIndexStorageAccessUnderTopFrameDomains)
    414422        || !m_database.executeCommand(createUniqueIndexTopFrameUniqueRedirectsTo)
     423        || !m_database.executeCommand(createUniqueIndexTopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement)
    415424        || !m_database.executeCommand(createUniqueIndexTopFrameUniqueRedirectsFrom)
    416425        || !m_database.executeCommand(createUniqueIndexTopFrameLinkDecorationsFrom)
    … …  
    447456    if (!m_database.executeCommand(createTopFrameUniqueRedirectsTo)) {
    448457        LOG_ERROR("Could not create TopFrameUniqueRedirectsTo table in database (%i) - %s", m_database.lastError(), m_database.lastErrorMsg());
     458        return false;
     459    }
     460
     461    if (!m_database.executeCommand(createTopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement)) {
     462        LOG_ERROR("Could not create TopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement table in database (%i) - %s", m_database.lastError(), m_database.lastErrorMsg());
    449463        return false;
    450464    }
    … …  
    693707    insertDomainRelationshipList(storageAccessUnderTopFrameDomainsQuery, loadStatistics.storageAccessUnderTopFrameDomains, registrableDomainID.value());
    694708    insertDomainRelationshipList(topFrameUniqueRedirectsToQuery, loadStatistics.topFrameUniqueRedirectsTo, registrableDomainID.value());
     709    insertDomainRelationshipList(topFrameUniqueRedirectsToSinceSameSiteStrictEnforcementQuery, loadStatistics.topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement, registrableDomainID.value());
    695710    insertDomainRelationshipList(topFrameUniqueRedirectsFromQuery, loadStatistics.topFrameUniqueRedirectsFrom, registrableDomainID.value());
    696711    insertDomainRelationshipList(subframeUnderTopFrameDomainsQuery, loadStatistics.subframeUnderTopFrameDomains, registrableDomainID.value());
    … …  
    16131628                }
    16141629                insertDomainRelationshipList(topFrameUniqueRedirectsToQuery, HashSet<RegistrableDomain>({ targetDomain }), *redirectingDomainResult.second);
     1630                insertDomainRelationshipList(topFrameUniqueRedirectsToSinceSameSiteStrictEnforcementQuery, HashSet<RegistrableDomain>({ targetDomain }), *redirectingDomainResult.second);
     1631                RELEASE_LOG_INFO_IF(debugLoggingEnabled(), ITPDebug, "Did set %" PUBLIC_LOG_STRING " as making a top frame redirect to %" PUBLIC_LOG_STRING ".", sourceDomain.string().utf8().data(), targetDomain.string().utf8().data());
    16151632                insertDomainRelationshipList(topFrameUniqueRedirectsFromQuery, HashSet<RegistrableDomain>({ sourceDomain }), *targetResult.second);
    16161633                statisticsWereUpdated = true;
    … …  
    16491666}
    16501667
     1668void ResourceLoadStatisticsDatabaseStore::clearTopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement(const RegistrableDomain& domain, CompletionHandler<void()>&& completionHandler)
     1669{
     1670    ASSERT(!RunLoop::isMain());
     1671
     1672    auto targetResult = ensureResourceStatisticsForRegistrableDomain(domain);
     1673    if (!targetResult.second) {
     1674        RELEASE_LOG_ERROR_IF_ALLOWED(m_sessionID, "%p - ResourceLoadStatisticsDatabaseStore::clearTopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement was not completed due to failed insert attempt", this);
     1675        completionHandler();
     1676        return;
     1677    }
     1678
     1679    SQLiteStatement removeRedirectsToSinceSameSite(m_database, "DELETE FROM TopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement WHERE sourceDomainID = ?");
     1680    if (removeRedirectsToSinceSameSite.prepare() != SQLITE_OK
     1681        || removeRedirectsToSinceSameSite.bindInt(1, *targetResult.second) != SQLITE_OK
     1682        || removeRedirectsToSinceSameSite.step() != SQLITE_DONE) {
     1683        RELEASE_LOG_ERROR_IF_ALLOWED(m_sessionID, "%p - ResourceLoadStatisticsDatabaseStore::clearTopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement failed to bind, error message: %{private}s", this, m_database.lastErrorMsg());
     1684        ASSERT_NOT_REACHED();
     1685    }
     1686   
     1687    completionHandler();
     1688}
     1689
    16511690void ResourceLoadStatisticsDatabaseStore::setUserInteraction(const RegistrableDomain& domain, bool hadUserInteraction, WallTime mostRecentInteraction)
    16521691{
    … …  
    16991738        || removeStorageAccess.bindInt(1, *targetResult.second) != SQLITE_OK
    17001739        || removeStorageAccess.step() != SQLITE_DONE) {
    1701         RELEASE_LOG_ERROR_IF_ALLOWED(m_sessionID, "%p - ResourceLoadStatisticsDatabaseStore::logUserInteraction failed to bind, error message: %{private}s", this, m_database.lastErrorMsg());
     1740        RELEASE_LOG_ERROR_IF_ALLOWED(m_sessionID, "%p - ResourceLoadStatisticsDatabaseStore::clearUserInteraction failed to bind, error message: %{private}s", this, m_database.lastErrorMsg());
    17021741        ASSERT_NOT_REACHED();
    17031742    }
    … …  
    20452084        return;
    20462085    }
    2047     // For consistency, make sure we also have a statistics entry for the redirect domain.
     2086
    20482087    insertDomainRelationshipList(topFrameUniqueRedirectsToQuery, HashSet<RegistrableDomain>({ redirectDomain }), *result.second);
     2088    insertDomainRelationshipList(topFrameUniqueRedirectsToSinceSameSiteStrictEnforcementQuery, HashSet<RegistrableDomain>({ redirectDomain }), *result.second);
    20492089}
    20502090
    … …  
    22582298   
    22592299    Vector<DomainData> results;
    2260     SQLiteStatement statement(m_database, "SELECT domainID, registrableDomain, mostRecentUserInteractionTime, hadUserInteraction, grandfathered, isScheduledForAllButCookieDataRemoval FROM ObservedDomains"_s);
     2300    SQLiteStatement statement(m_database, "SELECT domainID, registrableDomain, mostRecentUserInteractionTime, hadUserInteraction, grandfathered, isScheduledForAllButCookieDataRemoval, countOfTopFrameRedirects FROM ObservedDomains LEFT JOIN (SELECT sourceDomainID, COUNT(*) as countOfTopFrameRedirects from TopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement GROUP BY sourceDomainID) as z ON z.sourceDomainID = domainID"_s);
     2301
    22612302    if (statement.prepare() != SQLITE_OK)
    22622303        return results;
    … …  
    22692310            , statement.getColumnInt(4) ? true : false
    22702311            , statement.getColumnInt(5) ? true : false
     2312            , static_cast<unsigned>(statement.getColumnInt(6))
    22712313        });
    22722314    }
    … …  
    23812423}
    23822424
     2425bool ResourceLoadStatisticsDatabaseStore::shouldEnforceSameSiteStrictFor(DomainData& resourceStatistic, bool shouldCheckForGrandfathering)
     2426{
     2427    if (!isSameSiteStrictEnforcementEnabled() || (shouldCheckForGrandfathering && resourceStatistic.grandfathered))
     2428        return false;
     2429
     2430    if (resourceStatistic.topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement > parameters().minimumTopFrameRedirectsForSameSiteStrictEnforcement) {
     2431        clearTopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement(resourceStatistic.registrableDomain, [] { });
     2432        return true;
     2433    }
     2434
     2435    return false;
     2436}
     2437
    23832438RegistrableDomainsToDeleteOrRestrictWebsiteDataFor ResourceLoadStatisticsDatabaseStore::registrableDomainsToDeleteOrRestrictWebsiteDataFor()
    23842439{
    … …  
    24042459            toDeleteOrRestrictFor.domainsToDeleteAllCookiesFor.append(statistic.registrableDomain);
    24052460            toDeleteOrRestrictFor.domainsToDeleteAllNonCookieWebsiteDataFor.append(statistic.registrableDomain);
    2406         } else if (shouldRemoveAllButCookiesFor(statistic, shouldCheckForGrandfathering)) {
    2407             toDeleteOrRestrictFor.domainsToDeleteAllNonCookieWebsiteDataFor.append(statistic.registrableDomain);
    2408             setIsScheduledForAllButCookieDataRemoval(statistic.registrableDomain, false);
     2461        } else {
     2462            if (shouldRemoveAllButCookiesFor(statistic, shouldCheckForGrandfathering)) {
     2463                toDeleteOrRestrictFor.domainsToDeleteAllNonCookieWebsiteDataFor.append(statistic.registrableDomain);
     2464                setIsScheduledForAllButCookieDataRemoval(statistic.registrableDomain, false);
     2465            }
     2466            if (shouldEnforceSameSiteStrictFor(statistic, shouldCheckForGrandfathering)) {
     2467                toDeleteOrRestrictFor.domainsToEnforceSameSiteStrictFor.append(statistic.registrableDomain);
     2468                RELEASE_LOG_INFO_IF(debugLoggingEnabled(), ITPDebug, "Scheduled %" PUBLIC_LOG_STRING " to have its cookies set to SameSite=strict.", statistic.registrableDomain.string().utf8().data());
     2469            }
    24092470        }
    24102471        if (shouldClearGrandfathering && statistic.grandfathered)
    … …  
    26962757    // Top frame stats
    26972758    appendSubStatisticList(builder, "TopFrameUniqueRedirectsTo", domain);
     2759    appendSubStatisticList(builder, "TopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement", domain);
    26982760    appendSubStatisticList(builder, "TopFrameUniqueRedirectsFrom", domain);
    26992761    appendSubStatisticList(builder, "TopFrameLinkDecorationsFrom", domain);

  • trunk/Source/WebKit/NetworkProcess/Classifier/ResourceLoadStatisticsDatabaseStore.h

    r258969 r259275  
    126126
    127127    void logFrameNavigation(const NavigatedToDomain&, const TopFrameDomain&, const NavigatedFromDomain&, bool isRedirect, bool isMainFrame, Seconds delayAfterMainFrameDocumentLoad, bool wasPotentiallyInitiatedByUser) override;
     128    void logCrossSiteLoadWithLinkDecoration(const NavigatedFromDomain&, const NavigatedToDomain&) override;
     129    void clearTopFrameUniqueRedirectsToSinceSameSiteStrictEnforcement(const NavigatedToDomain&, CompletionHandler<void()>&&);
     130
    128131    void logUserInteraction(const TopFrameDomain&, CompletionHandler<void()>&&) override;
    129     void logCrossSiteLoadWithLinkDecoration(const NavigatedFromDomain&, const NavigatedToDomain&) override;
    130 
    131132    void clearUserInteraction(const RegistrableDomain&, CompletionHandler<void()>&&) override;
    132133    bool hasHadUserInteraction(const RegistrableDomain&, OperatingDatesWindow) override;
    … …  
    179180        bool grandfathered;
    180181        bool isScheduledForAllButCookieDataRemoval;
     182        unsigned topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement;
    181183    };
    182184    Vector<DomainData> domains() const;
    … …  
    216218    bool shouldRemoveAllWebsiteDataFor(const DomainData&, bool shouldCheckForGrandfathering);
    217219    bool shouldRemoveAllButCookiesFor(const DomainData&, bool shouldCheckForGrandfathering);
     220    bool shouldEnforceSameSiteStrictFor(DomainData&, bool shouldCheckForGrandfathering);
    218221    RegistrableDomainsToDeleteOrRestrictWebsiteDataFor registrableDomainsToDeleteOrRestrictWebsiteDataFor() override;
    219222    bool isDatabaseStore() const final { return true; }

  • trunk/Source/WebKit/NetworkProcess/Classifier/ResourceLoadStatisticsMemoryStore.cpp

    r259236 r259275  
    475475                if (redirectingDomainStatistics.topFrameUniqueRedirectsTo.add(targetDomain).isNewEntry)
    476476                    statisticsWereUpdated = true;
     477                if (redirectingDomainStatistics.topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement.add(targetDomain).isNewEntry)
     478                    statisticsWereUpdated = true;
     479                RELEASE_LOG_INFO_IF(debugLoggingEnabled(), ITPDebug, "Did set %" PUBLIC_LOG_STRING " as making a top frame redirect to %" PUBLIC_LOG_STRING ".", sourceDomain.string().utf8().data(), targetDomain.string().utf8().data());
    477480                auto& targetStatistics = ensureResourceStatisticsForRegistrableDomain(targetDomain);
    478481                if (targetStatistics.topFrameUniqueRedirectsFrom.add(sourceDomain).isNewEntry)
    … …  
    713716    auto& statistics = ensureResourceStatisticsForRegistrableDomain(topFrameDomain);
    714717    statistics.topFrameUniqueRedirectsTo.add(redirectDomain);
     718    statistics.topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement.add(redirectDomain);
    715719    // For consistency, make sure we also have a statistics entry for the redirect domain.
    716720    ensureResourceStatisticsForRegistrableDomain(redirectDomain);
    … …  
    944948}
    945949
     950bool ResourceLoadStatisticsMemoryStore::shouldEnforceSameSiteStrictFor(ResourceLoadStatistics& resourceStatistic, bool shouldCheckForGrandfathering)
     951{
     952    if (!isSameSiteStrictEnforcementEnabled() || (shouldCheckForGrandfathering && resourceStatistic.grandfathered))
     953        return false;
     954
     955    if (resourceStatistic.topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement.size() > parameters().minimumTopFrameRedirectsForSameSiteStrictEnforcement) {
     956        resourceStatistic.topFrameUniqueRedirectsToSinceSameSiteStrictEnforcement.clear();
     957        return true;
     958    }
     959
     960    return false;
     961}
     962
    946963RegistrableDomainsToDeleteOrRestrictWebsiteDataFor ResourceLoadStatisticsMemoryStore::registrableDomainsToDeleteOrRestrictWebsiteDataFor()
    947964{
    … …  
    962979            toDeleteOrRestrictFor.domainsToDeleteAllCookiesFor.append(statistic.registrableDomain);
    963980            toDeleteOrRestrictFor.domainsToDeleteAllNonCookieWebsiteDataFor.append(statistic.registrableDomain);
    964         } else if (shouldRemoveAllButCookiesFor(statistic, shouldCheckForGrandfathering)) {
    965             toDeleteOrRestrictFor.domainsToDeleteAllNonCookieWebsiteDataFor.append(statistic.registrableDomain);
    966             statistic.gotLinkDecorationFromPrevalentResource = false;
     981        } else {
     982            if (shouldRemoveAllButCookiesFor(statistic, shouldCheckForGrandfathering)) {
     983                toDeleteOrRestrictFor.domainsToDeleteAllNonCookieWebsiteDataFor.append(statistic.registrableDomain);
     984                statistic.gotLinkDecorationFromPrevalentResource = false;
     985            }
     986            if (shouldEnforceSameSiteStrictFor(statistic, shouldCheckForGrandfathering)) {
     987                toDeleteOrRestrictFor.domainsToEnforceSameSiteStrictFor.append(statistic.registrableDomain);
     988                RELEASE_LOG_INFO_IF(debugLoggingEnabled(), ITPDebug, "Scheduled %" PUBLIC_LOG_STRING " to have its cookies set to SameSite=strict.", statistic.registrableDomain.string().utf8().data());
     989
     990            }
    967991        }
    968992

  • trunk/Source/WebKit/NetworkProcess/Classifier/ResourceLoadStatisticsMemoryStore.h

    r258969 r259275  
    121121    bool shouldRemoveAllWebsiteDataFor(ResourceLoadStatistics&, bool shouldCheckForGrandfathering) const;
    122122    bool shouldRemoveAllButCookiesFor(ResourceLoadStatistics&, bool shouldCheckForGrandfathering) const;
     123    bool shouldEnforceSameSiteStrictFor(ResourceLoadStatistics&, bool shouldCheckForGrandfathering);
    123124    void incrementRecordsDeletedCountForDomains(HashSet<RegistrableDomain>&&) override;
    124125    void setPrevalentResource(ResourceLoadStatistics&, ResourceLoadPrevalence);

  • trunk/Source/WebKit/NetworkProcess/Classifier/ResourceLoadStatisticsStore.h

    r259236 r259275  
    166166    void setThirdPartyCookieBlockingMode(WebCore::ThirdPartyCookieBlockingMode mode) { m_thirdPartyCookieBlockingMode = mode; };
    167167    WebCore::ThirdPartyCookieBlockingMode thirdPartyCookieBlockingMode() const { return m_thirdPartyCookieBlockingMode; };
     168    void setSameSiteStrictEnforcementEnabled(WebCore::SameSiteStrictEnforcementEnabled enabled) { m_sameSiteStrictEnforcementEnabled = enabled; };
     169    bool isSameSiteStrictEnforcementEnabled() const { return m_sameSiteStrictEnforcementEnabled == WebCore::SameSiteStrictEnforcementEnabled::Yes; };
    168170    void setFirstPartyWebsiteDataRemovalMode(WebCore::FirstPartyWebsiteDataRemovalMode mode) { m_firstPartyWebsiteDataRemovalMode = mode; }
    169171
    … …  
    226228        bool shouldNotifyPagesWhenDataRecordsWereScanned { false };
    227229        bool shouldClassifyResourcesBeforeDataRecordsRemoval { true };
     230        size_t minimumTopFrameRedirectsForSameSiteStrictEnforcement { 10 };
    228231        bool shouldSubmitTelemetry { true };
    229232        bool isRunningTest { false };
    … …  
    279282    bool m_debugModeEnabled { false };
    280283    WebCore::ThirdPartyCookieBlockingMode m_thirdPartyCookieBlockingMode { WebCore::ThirdPartyCookieBlockingMode::All };
     284    WebCore::SameSiteStrictEnforcementEnabled m_sameSiteStrictEnforcementEnabled { WebCore::SameSiteStrictEnforcementEnabled::No };
    281285    bool m_dataRecordsBeingRemoved { false };
    282286    ShouldIncludeLocalhost m_shouldIncludeLocalhost { ShouldIncludeLocalhost::Yes };

  • trunk/Source/WebKit/NetworkProcess/Classifier/WebResourceLoadStatisticsStore.cpp

    r258969 r259275  
    600600}
    601601
     602void WebResourceLoadStatisticsStore::setSameSiteStrictEnforcementEnabled(SameSiteStrictEnforcementEnabled enabled)
     603{
     604    ASSERT(RunLoop::isMain());
     605
     606    if (isEphemeral())
     607        return;
     608
     609    postTask([this, enabled]() {
     610        if (!m_statisticsStore)
     611            return;
     612
     613        m_statisticsStore->setSameSiteStrictEnforcementEnabled(enabled);
     614    });
     615}
     616
    602617void WebResourceLoadStatisticsStore::setFirstPartyWebsiteDataRemovalMode(FirstPartyWebsiteDataRemovalMode mode, CompletionHandler<void()>&& completionHandler)
    603618{

  • trunk/Source/WebKit/NetworkProcess/Classifier/WebResourceLoadStatisticsStore.h

    r258969 r259275  
    8181    Vector<WebCore::RegistrableDomain> domainsToDeleteAllButHttpOnlyCookiesFor;
    8282    Vector<WebCore::RegistrableDomain> domainsToDeleteAllNonCookieWebsiteDataFor;
    83     RegistrableDomainsToDeleteOrRestrictWebsiteDataFor isolatedCopy() const { return { domainsToDeleteAllCookiesFor.isolatedCopy(), domainsToDeleteAllButHttpOnlyCookiesFor.isolatedCopy(), domainsToDeleteAllNonCookieWebsiteDataFor.isolatedCopy() }; }
    84     bool isEmpty() const { return domainsToDeleteAllCookiesFor.isEmpty() && domainsToDeleteAllButHttpOnlyCookiesFor.isEmpty() && domainsToDeleteAllNonCookieWebsiteDataFor.isEmpty(); }
     83    Vector<WebCore::RegistrableDomain> domainsToEnforceSameSiteStrictFor;
     84    RegistrableDomainsToDeleteOrRestrictWebsiteDataFor isolatedCopy() const { return { domainsToDeleteAllCookiesFor.isolatedCopy(), domainsToDeleteAllButHttpOnlyCookiesFor.isolatedCopy(), domainsToDeleteAllNonCookieWebsiteDataFor.isolatedCopy(), domainsToEnforceSameSiteStrictFor.isolatedCopy() }; }
     85    bool isEmpty() const { return domainsToDeleteAllCookiesFor.isEmpty() && domainsToDeleteAllButHttpOnlyCookiesFor.isEmpty() && domainsToDeleteAllNonCookieWebsiteDataFor.isEmpty() && domainsToEnforceSameSiteStrictFor.isEmpty(); }
    8586};
    8687
    … …  
    275276    void hasCookies(const RegistrableDomain&, CompletionHandler<void(bool)>&&);
    276277    void setThirdPartyCookieBlockingMode(WebCore::ThirdPartyCookieBlockingMode);
     278    void setSameSiteStrictEnforcementEnabled(WebCore::SameSiteStrictEnforcementEnabled);
    277279    void setFirstPartyWebsiteDataRemovalMode(WebCore::FirstPartyWebsiteDataRemovalMode, CompletionHandler<void()>&&);
    278280    void didCreateNetworkProcess();

  • trunk/Source/WebKit/NetworkProcess/NetworkProcess.cpp

    r259236 r259275  
    12951295}
    12961296
     1297void NetworkProcess::setShouldEnbleSameSiteStrictEnforcementForTesting(PAL::SessionID sessionID, WebCore::SameSiteStrictEnforcementEnabled enabled, CompletionHandler<void()>&& completionHandler)
     1298{
     1299    if (auto* networkSession = this->networkSession(sessionID))
     1300        networkSession->setShouldEnbleSameSiteStrictEnforcement(enabled);
     1301    else
     1302        ASSERT_NOT_REACHED();
     1303    completionHandler();
     1304}
     1305
    12971306void NetworkProcess::setFirstPartyWebsiteDataRemovalModeForTesting(PAL::SessionID sessionID, WebCore::FirstPartyWebsiteDataRemovalMode mode, CompletionHandler<void()>&& completionHandler)
    12981307{

  • trunk/Source/WebKit/NetworkProcess/NetworkProcess.h

    r259236 r259275  
    266266    void setShouldDowngradeReferrerForTesting(bool, CompletionHandler<void()>&&);
    267267    void setShouldBlockThirdPartyCookiesForTesting(PAL::SessionID, WebCore::ThirdPartyCookieBlockingMode, CompletionHandler<void()>&&);
     268    void setShouldEnbleSameSiteStrictEnforcementForTesting(PAL::SessionID, WebCore::SameSiteStrictEnforcementEnabled, CompletionHandler<void()>&&);
    268269    void setFirstPartyWebsiteDataRemovalModeForTesting(PAL::SessionID, WebCore::FirstPartyWebsiteDataRemovalMode, CompletionHandler<void()>&&);
    269270    void setToSameSiteStrictCookiesForTesting(PAL::SessionID, const WebCore::RegistrableDomain&, CompletionHandler<void()>&&);

  • trunk/Source/WebKit/NetworkProcess/NetworkProcess.messages.in

    r258914 r259275  
    141141    SetShouldDowngradeReferrerForTesting(bool enabled) -> () Async
    142142    SetShouldBlockThirdPartyCookiesForTesting(PAL::SessionID sessionID, enum:uint8_t WebCore::ThirdPartyCookieBlockingMode blockingMode) -> () Async
     143    SetShouldEnbleSameSiteStrictEnforcementForTesting(PAL::SessionID sessionID, enum:bool WebCore::SameSiteStrictEnforcementEnabled enabled) -> () Async
    143144    SetFirstPartyWebsiteDataRemovalModeForTesting(PAL::SessionID sessionID, enum:uint8_t WebCore::FirstPartyWebsiteDataRemovalMode mode) -> () Async
    144145    SetToSameSiteStrictCookiesForTesting(PAL::SessionID sessionID, WebCore::RegistrableDomain domain) -> () Async

  • trunk/Source/WebKit/NetworkProcess/NetworkSession.cpp

    r259236 r259275  
    8787    , m_enableResourceLoadStatisticsLogTestingEvent(parameters.resourceLoadStatisticsParameters.enableLogTestingEvent)
    8888    , m_thirdPartyCookieBlockingMode(parameters.resourceLoadStatisticsParameters.thirdPartyCookieBlockingMode)
     89    , m_sameSiteStrictEnforcementEnabled(parameters.resourceLoadStatisticsParameters.sameSiteStrictEnforcementEnabled)
    8990    , m_firstPartyWebsiteDataRemovalMode(parameters.resourceLoadStatisticsParameters.firstPartyWebsiteDataRemovalMode)
    9091#endif
    … …  
    201202{
    202203    m_resourceLoadStatistics->setThirdPartyCookieBlockingMode(m_thirdPartyCookieBlockingMode);
     204    m_resourceLoadStatistics->setSameSiteStrictEnforcementEnabled(m_sameSiteStrictEnforcementEnabled);
    203205    m_resourceLoadStatistics->setFirstPartyWebsiteDataRemovalMode(m_firstPartyWebsiteDataRemovalMode, [] { });
    204206}
    … …  
    226228void NetworkSession::deleteAndRestrictWebsiteDataForRegistrableDomains(OptionSet<WebsiteDataType> dataTypes, RegistrableDomainsToDeleteOrRestrictWebsiteDataFor&& domains, bool shouldNotifyPage, CompletionHandler<void(const HashSet<RegistrableDomain>&)>&& completionHandler)
    227229{
     230    if (auto* storageSession = networkStorageSession()) {
     231        for (auto& domain : domains.domainsToEnforceSameSiteStrictFor)
     232            storageSession->setAllCookiesToSameSiteStrict(domain, [] { });
     233    }
     234    domains.domainsToEnforceSameSiteStrictFor.clear();
     235
    228236    m_networkProcess->deleteAndRestrictWebsiteDataForRegistrableDomains(m_sessionID, dataTypes, WTFMove(domains), shouldNotifyPage, WTFMove(completionHandler));
    229237}
    … …  
    251259        m_resourceLoadStatistics->setThirdPartyCookieBlockingMode(blockingMode);
    252260}
     261
     262void NetworkSession::setShouldEnbleSameSiteStrictEnforcement(WebCore::SameSiteStrictEnforcementEnabled enabled)
     263{
     264    ASSERT(m_resourceLoadStatistics);
     265    m_sameSiteStrictEnforcementEnabled = enabled;
     266    if (m_resourceLoadStatistics)
     267        m_resourceLoadStatistics->setSameSiteStrictEnforcementEnabled(enabled);
     268}
    253269#endif // ENABLE(RESOURCE_LOAD_STATISTICS)
    254270

  • trunk/Source/WebKit/NetworkProcess/NetworkSession.h

    r259076 r259275  
    105105    bool shouldDowngradeReferrer() const;
    106106    void setThirdPartyCookieBlockingMode(WebCore::ThirdPartyCookieBlockingMode);
     107    void setShouldEnbleSameSiteStrictEnforcement(WebCore::SameSiteStrictEnforcementEnabled);
    107108#endif
    108109   
    … …  
    162163    bool m_downgradeReferrer { true };
    163164    WebCore::ThirdPartyCookieBlockingMode m_thirdPartyCookieBlockingMode { WebCore::ThirdPartyCookieBlockingMode::All };
     165    WebCore::SameSiteStrictEnforcementEnabled m_sameSiteStrictEnforcementEnabled { WebCore::SameSiteStrictEnforcementEnabled::No };
    164166    WebCore::FirstPartyWebsiteDataRemovalMode m_firstPartyWebsiteDataRemovalMode { WebCore::FirstPartyWebsiteDataRemovalMode::AllButCookies };
    165167#endif

  • trunk/Source/WebKit/Scripts/webkit/messages.py

    r259200 r259275  
    629629        'WebCore::TextIndicatorData': ['<WebCore/TextIndicator.h>'],
    630630        'WebCore::ThirdPartyCookieBlockingMode': ['<WebCore/NetworkStorageSession.h>'],
     631        'WebCore::SameSiteStrictEnforcementEnabled': ['<WebCore/NetworkStorageSession.h>'],
    631632        'WebCore::FirstPartyWebsiteDataRemovalMode': ['<WebCore/NetworkStorageSession.h>'],
    632633        'WebCore::UsedLegacyTLS': ['<WebCore/ResourceResponseBase.h>'],

  • trunk/Source/WebKit/Shared/ResourceLoadStatisticsParameters.h

    r258269 r259275  
    4545#if ENABLE(RESOURCE_LOAD_STATISTICS)
    4646    WebCore::ThirdPartyCookieBlockingMode thirdPartyCookieBlockingMode { WebCore::ThirdPartyCookieBlockingMode::All };
     47    WebCore::SameSiteStrictEnforcementEnabled sameSiteStrictEnforcementEnabled { WebCore::SameSiteStrictEnforcementEnabled::No };
    4748#endif
    4849    WebCore::FirstPartyWebsiteDataRemovalMode firstPartyWebsiteDataRemovalMode { WebCore::FirstPartyWebsiteDataRemovalMode::AllButCookies };
    … …  
    6061#if ENABLE(RESOURCE_LOAD_STATISTICS)
    6162        encoder << thirdPartyCookieBlockingMode;
     63        encoder << sameSiteStrictEnforcementEnabled;
    6264#endif
    6365        encoder << firstPartyWebsiteDataRemovalMode;
    … …  
    107109        if (!thirdPartyCookieBlockingMode)
    108110            return WTF::nullopt;
     111
     112        Optional<WebCore::SameSiteStrictEnforcementEnabled> sameSiteStrictEnforcementEnabled;
     113        decoder >> sameSiteStrictEnforcementEnabled;
     114        if (!sameSiteStrictEnforcementEnabled)
     115            return WTF::nullopt;
    109116#endif
    110117
    … …  
    129136#if ENABLE(RESOURCE_LOAD_STATISTICS)
    130137            WTFMove(*thirdPartyCookieBlockingMode),
     138            WTFMove(*sameSiteStrictEnforcementEnabled),
    131139#endif
    132140            WTFMove(*firstPartyWebsiteDataRemovalMode),

  • trunk/Source/WebKit/Shared/WebPreferences.yaml

    r258678 r259275  
    19291929  category: internal
    19301930
     1931IsSameSiteStrictEnforcementEnabled:
     1932  type: bool
     1933  defaultValue: false
     1934  humanReadableName: "SameSite strict enforcement (ITP)"
     1935  humanReadableDescription: "Enable SameSite strict enforcement to mitigate bounce tracking"
     1936  category: experimental
     1937
    19311938IsLoggedInAPIEnabled:
    19321939    type: bool

  • trunk/Source/WebKit/UIProcess/API/APINavigation.h

    r255992 r259275  
    157157    void setForegroundActivity(std::unique_ptr<WebKit::ProcessThrottler::ForegroundActivity>&& activity) { m_foregroundActivity = WTFMove(activity); }
    158158
     159    void setIsLoadedWithNavigationShared(bool value) { m_isLoadedWithNavigationShared = value; }
     160    bool isLoadedWithNavigationShared() const { return m_isLoadedWithNavigationShared; }
     161
    159162private:
    160163    explicit Navigation(WebKit::WebNavigationState&);
    … …  
    179182    WebKit::WebContentMode m_effectiveContentMode { WebKit::WebContentMode::Recommended };
    180183    std::unique_ptr<WebKit::ProcessThrottler::ForegroundActivity> m_foregroundActivity;
     184    bool m_isLoadedWithNavigationShared { false };
    181185};
    182186

  • trunk/Source/WebKit/UIProcess/API/C/WKWebsiteDataStoreRef.cpp

    r258884 r259275  
    607607    store.setResourceLoadStatisticsShouldDowngradeReferrerForTesting(true, [callbackAggregator = callbackAggregator.copyRef()] { });
    608608    store.setResourceLoadStatisticsShouldBlockThirdPartyCookiesForTesting(false, false, [callbackAggregator = callbackAggregator.copyRef()] { });
     609    store.setResourceLoadStatisticsShouldEnbleSameSiteStrictEnforcementForTesting(true, [callbackAggregator = callbackAggregator.copyRef()] { });
    609610    store.setResourceLoadStatisticsFirstPartyWebsiteDataRemovalModeForTesting(false, [callbackAggregator = callbackAggregator.copyRef()] { });
    610611    store.resetParametersToDefaultValues([callbackAggregator = callbackAggregator.copyRef()] { });

  • trunk/Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp

    r258914 r259275  
    11571157}
    11581158
     1159void NetworkProcessProxy::setShouldEnbleSameSiteStrictEnforcementForTesting(PAL::SessionID sessionID, WebCore::SameSiteStrictEnforcementEnabled enabled, CompletionHandler<void()>&& completionHandler)
     1160{
     1161    sendWithAsyncReply(Messages::NetworkProcess::SetShouldEnbleSameSiteStrictEnforcementForTesting(sessionID, enabled), WTFMove(completionHandler));
     1162}
     1163
    11591164void NetworkProcessProxy::setFirstPartyWebsiteDataRemovalModeForTesting(PAL::SessionID sessionID, FirstPartyWebsiteDataRemovalMode mode, CompletionHandler<void()>&& completionHandler)
    11601165{

  • trunk/Source/WebKit/UIProcess/Network/NetworkProcessProxy.h

    r258914 r259275  
    174174    void setShouldDowngradeReferrerForTesting(bool, CompletionHandler<void()>&&);
    175175    void setShouldBlockThirdPartyCookiesForTesting(PAL::SessionID, WebCore::ThirdPartyCookieBlockingMode, CompletionHandler<void()>&&);
     176    void setShouldEnbleSameSiteStrictEnforcementForTesting(PAL::SessionID, WebCore::SameSiteStrictEnforcementEnabled, CompletionHandler<void()>&&);
    176177    void setFirstPartyWebsiteDataRemovalModeForTesting(PAL::SessionID, WebCore::FirstPartyWebsiteDataRemovalMode, CompletionHandler<void()>&&);
    177178    void setToSameSiteStrictCookiesForTesting(PAL::SessionID, const RegistrableDomain&, CompletionHandler<void()>&&);

  • trunk/Source/WebKit/UIProcess/WebPageProxy.cpp

    r259242 r259275  
    13311331    preconnectTo(url);
    13321332
     1333    navigation.setIsLoadedWithNavigationShared(true);
     1334
    13331335#if HAVE(SANDBOX_ISSUE_READ_EXTENSION_TO_PROCESS_BY_AUDIT_TOKEN)
    13341336    if (!process->isLaunching() || !url.isLocalFile())
    … …  
    51695171    auto userInitiatedActivity = process->userInitiatedActivity(navigationActionData.userGestureTokenIdentifier);
    51705172#if ENABLE(RESOURCE_LOAD_STATISTICS)
     5173    auto wasPotentiallyInitiatedByUser = navigation->isLoadedWithNavigationShared() || userInitiatedActivity;
    51715174    if (!sessionID().isEphemeral())
    5172         logFrameNavigation(frame, URL(URL(), m_pageLoadState.url()), request, redirectResponse.url(), !!userInitiatedActivity);
     5175        logFrameNavigation(frame, URL(URL(), m_pageLoadState.url()), request, redirectResponse.url(), wasPotentiallyInitiatedByUser);
    51735176#endif
    51745177

  • trunk/Source/WebKit/UIProcess/WebProcessPool.cpp

    r259049 r259275  
    601601#endif
    602602    WebCore::FirstPartyWebsiteDataRemovalMode firstPartyWebsiteDataRemovalMode = WebCore::FirstPartyWebsiteDataRemovalMode::AllButCookies;
     603    WebCore::SameSiteStrictEnforcementEnabled sameSiteStrictEnforcementEnabled = WebCore::SameSiteStrictEnforcementEnabled::No;
    603604    WebCore::RegistrableDomain manualPrevalentResource { };
    604605    WEB_PROCESS_POOL_ADDITIONS_2
    … …  
    614615#if ENABLE(RESOURCE_LOAD_STATISTICS)
    615616            thirdPartyCookieBlockingMode = networkSessionParameters.resourceLoadStatisticsParameters.thirdPartyCookieBlockingMode;
     617            sameSiteStrictEnforcementEnabled = networkSessionParameters.resourceLoadStatisticsParameters.sameSiteStrictEnforcementEnabled;
    616618#endif
    617619            firstPartyWebsiteDataRemovalMode = networkSessionParameters.resourceLoadStatisticsParameters.firstPartyWebsiteDataRemovalMode;
    … …  
    638640#if ENABLE(RESOURCE_LOAD_STATISTICS)
    639641            thirdPartyCookieBlockingMode = networkSessionParameters.resourceLoadStatisticsParameters.thirdPartyCookieBlockingMode;
     642            sameSiteStrictEnforcementEnabled = networkSessionParameters.resourceLoadStatisticsParameters.sameSiteStrictEnforcementEnabled;
    640643#endif
    641644            firstPartyWebsiteDataRemovalMode = networkSessionParameters.resourceLoadStatisticsParameters.firstPartyWebsiteDataRemovalMode;
    … …  
    676679#if ENABLE(RESOURCE_LOAD_STATISTICS)
    677680        thirdPartyCookieBlockingMode,
     681        sameSiteStrictEnforcementEnabled,
    678682#endif
    679683        firstPartyWebsiteDataRemovalMode,

  • trunk/Source/WebKit/UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm

    r259240 r259275  
    100100    bool shouldLogCookieInformation = false;
    101101    bool enableResourceLoadStatisticsDebugMode = false;
     102    auto sameSiteStrictEnforcementEnabled = WebCore::SameSiteStrictEnforcementEnabled::No;
    102103    auto firstPartyWebsiteDataRemovalMode = WebCore::FirstPartyWebsiteDataRemovalMode::AllButCookies;
    103104    WebCore::RegistrableDomain resourceLoadStatisticsManualPrevalentResource { };
    104105#if ENABLE(RESOURCE_LOAD_STATISTICS)
    105106    enableResourceLoadStatisticsDebugMode = [defaults boolForKey:@"ITPDebugMode"];
     107
     108    if ([defaults boolForKey:[NSString stringWithFormat:@"Experimental%@", WebPreferencesKey::isSameSiteStrictEnforcementEnabledKey().createCFString().get()]])
     109        sameSiteStrictEnforcementEnabled = WebCore::SameSiteStrictEnforcementEnabled::Yes;
     110
    106111    if ([defaults boolForKey:[NSString stringWithFormat:@"Experimental%@", WebPreferencesKey::isFirstPartyWebsiteDataRemovalDisabledKey().createCFString().get()]])
    107112        firstPartyWebsiteDataRemovalMode = WebCore::FirstPartyWebsiteDataRemovalMode::None;
    … …  
    182187        enableResourceLoadStatisticsDebugMode,
    183188        thirdPartyCookieBlockingMode(),
     189        sameSiteStrictEnforcementEnabled,
    184190        firstPartyWebsiteDataRemovalMode,
    185191        WTFMove(resourceLoadStatisticsManualPrevalentResource),

  • trunk/Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp

    r258914 r259275  
    18481848}
    18491849
     1850void WebsiteDataStore::setResourceLoadStatisticsShouldEnbleSameSiteStrictEnforcementForTesting(bool enabled, CompletionHandler<void()>&& completionHandler)
     1851{
     1852    auto flag = enabled ? WebCore::SameSiteStrictEnforcementEnabled::Yes : WebCore::SameSiteStrictEnforcementEnabled::No;
     1853
     1854    auto callbackAggregator = CallbackAggregator::create(WTFMove(completionHandler));
     1855    for (auto& processPool : processPools()) {
     1856        if (auto* networkProcess = processPool->networkProcess())
     1857            networkProcess->setShouldEnbleSameSiteStrictEnforcementForTesting(m_sessionID, flag, [callbackAggregator = callbackAggregator.copyRef()] { });
     1858    }
     1859}
     1860
    18501861void WebsiteDataStore::setResourceLoadStatisticsFirstPartyWebsiteDataRemovalModeForTesting(bool enabled, CompletionHandler<void()>&& completionHandler)
    18511862{

  • trunk/Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h

    r259240 r259275  
    196196    void setResourceLoadStatisticsShouldDowngradeReferrerForTesting(bool, CompletionHandler<void()>&&);
    197197    void setResourceLoadStatisticsShouldBlockThirdPartyCookiesForTesting(bool enabled, bool onlyOnSitesWithoutUserInteraction, CompletionHandler<void()>&&);
     198    void setResourceLoadStatisticsShouldEnbleSameSiteStrictEnforcementForTesting(bool enabled, CompletionHandler<void()>&&);
    198199    void setResourceLoadStatisticsFirstPartyWebsiteDataRemovalModeForTesting(bool enabled, CompletionHandler<void()>&&);
    199200    void setResourceLoadStatisticsToSameSiteStrictCookiesForTesting(const URL&, CompletionHandler<void()>&&);
Note: See TracChangeset for help on using the changeset viewer.