Changeset 286971 in webkit

Timestamp:

Dec 13, 2021, 12:29:59 PM (5 years ago)

Author:

Chris Dumez

Message:

Regression(r283565) Unable to report private messages as Spam in Twitter app
​https://bugs.webkit.org/show_bug.cgi?id=234253
<rdar://86043227>

Reviewed by Alex Christensen.

Source/WebCore:

Add macro for new linkedOnOrAfter check for sending the Authorization header
on same origin redirects.

• platform/cocoa/VersionChecks.h:

Source/WebKit:

In r283565, we aligned WebKit's behavior with the Fetch specification and with
Gecko / Blink by keeping the Authorization header on same origin redirects.

However, when reporting a private message in the twitter app, it does a
same-origin redirect from https://twitter.com/account/authenticate_web_view?...
to https://twitter.com/account/authenticate_web_view?... and the HTTP server
reponds with a 401/Unauthorized when we send the Authorization on the post-redirect
request. As far as I can tell, our behavior is correct here and I suspect this is an
issue with the twitter server. As a result, I am simply gating the new behavior
behind a linked-on-or-after check to give twitter a chance to address the issue on
their end.

• NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:

(WebKit::NetworkDataTaskCocoa::willPerformHTTPRedirection):

Source/WTF:

Add some new iOS / macOS versions.

• wtf/spi/darwin/dyldSPI.h:

Location:

trunk/Source

Files:

• WTF/ChangeLog (modified) (1 diff)
• WTF/wtf/spi/darwin/dyldSPI.h (modified) (2 diffs)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/platform/cocoa/VersionChecks.h (modified) (2 diffs)
• WebKit/ChangeLog (modified) (1 diff)
• WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm (modified) (2 diffs)

trunk/Source/WTF/ChangeLog

@@ +1 @@
+2021-12-13  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r283565) Unable to report private messages as Spam in Twitter app
+        https://bugs.webkit.org/show_bug.cgi?id=234253
+        <rdar://86043227>
+
+        Reviewed by Alex Christensen.
+
+        Add some new iOS / macOS versions.
+
+        * wtf/spi/darwin/dyldSPI.h:
+
 2021-12-13  Elliott Williams  <emw@apple.com>
 

trunk/Source/WTF/wtf/spi/darwin/dyldSPI.h

@@ -134 +134 @@
 #define DYLD_IOS_VERSION_14_5 0x000E0500
 #define DYLD_IOS_VERSION_15_0 0x000f0000
+#define DYLD_IOS_VERSION_15_4 0x000f0400
 #define DYLD_IOS_VERSION_16_0 0x00100000
 
@@ -146 +147 @@
 #define DYLD_MACOSX_VERSION_11_3 0x000B0300
 #define DYLD_MACOSX_VERSION_12_00 0x000c0000
+#define DYLD_MACOSX_VERSION_12_3 0x000c0300
 #define DYLD_MACOSX_VERSION_13_0 0x000d0000
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-12-13  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r283565) Unable to report private messages as Spam in Twitter app
+        https://bugs.webkit.org/show_bug.cgi?id=234253
+        <rdar://86043227>
+
+        Reviewed by Alex Christensen.
+
+        Add macro for new linkedOnOrAfter check for sending the Authorization header
+        on same origin redirects.
+
+        * platform/cocoa/VersionChecks.h:
+
 2021-12-13  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebCore/platform/cocoa/VersionChecks.h

@@ -73 +73 @@
     FirstWithApplicationCacheDisabledByDefault = DYLD_IOS_VERSION_15_0,
     FirstWithoutExpandoIndexedPropertiesOnWindow = DYLD_IOS_VERSION_15_0,
+    FirstWithAuthorizationHeaderOnSameOriginRedirects = DYLD_IOS_VERSION_15_4,
     FirstForbiddingDotPrefixedFonts = DYLD_IOS_VERSION_16_0,
 #elif PLATFORM(MAC)
@@ -100 +101 @@
     FirstWithApplicationCacheDisabledByDefault = DYLD_MACOSX_VERSION_12_00,
     FirstWithoutExpandoIndexedPropertiesOnWindow = DYLD_MACOSX_VERSION_12_00,
+    FirstWithAuthorizationHeaderOnSameOriginRedirects = DYLD_MACOSX_VERSION_12_3,
     FirstForbiddingDotPrefixedFonts = DYLD_MACOSX_VERSION_13_0,
 #endif

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-12-13  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r283565) Unable to report private messages as Spam in Twitter app
+        https://bugs.webkit.org/show_bug.cgi?id=234253
+        <rdar://86043227>
+
+        Reviewed by Alex Christensen.
+
+        In r283565, we aligned WebKit's behavior with the Fetch specification and with
+        Gecko / Blink by keeping the Authorization header on same origin redirects.
+
+        However, when reporting a private message in the twitter app, it does a
+        same-origin redirect from `https://twitter.com/account/authenticate_web_view?...`
+        to `https://twitter.com/account/authenticate_web_view?...` and the HTTP server
+        reponds with a 401/Unauthorized when we send the Authorization on the post-redirect
+        request. As far as I can tell, our behavior is correct here and I suspect this is an
+        issue with the twitter server. As a result, I am simply gating the new behavior
+        behind a linked-on-or-after check to give twitter a chance to address the issue on
+        their end.
+
+        * NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:
+        (WebKit::NetworkDataTaskCocoa::willPerformHTTPRedirection):
+
 2021-12-13  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm

@@ -42 +42 @@
 #import <WebCore/ResourceRequest.h>
 #import <WebCore/TimingAllowOrigin.h>
+#import <WebCore/VersionChecks.h>
 #import <pal/spi/cf/CFNetworkSPI.h>
 #import <wtf/BlockPtr.h>
@@ -496 +497 @@
 
     } else {
-        if (auto authorization = m_firstRequest.httpHeaderField(WebCore::HTTPHeaderName::Authorization); !authorization.isNull())
+        if (auto authorization = m_firstRequest.httpHeaderField(WebCore::HTTPHeaderName::Authorization); !authorization.isNull() && linkedOnOrAfter(WebCore::SDKVersion::FirstWithAuthorizationHeaderOnSameOriginRedirects))
             request.setHTTPHeaderField(WebCore::HTTPHeaderName::Authorization, authorization);