Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a5cb75b185b29fd58ceb6bdb72e67443e03cf918
https://github.com/WebKit/WebKit/commit/a5cb75b185b29fd58ceb6bdb72e67443e03cf918
Author: Zak Ridouh <[email protected]>
Date: 2026-10-13 (Tue, 13 Oct 2026)
Changed paths:
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h
M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in
M Source/WebKit/NetworkProcess/NetworkProcess.cpp
M Source/WebKit/NetworkProcess/NetworkProcess.h
M Source/WebKit/NetworkProcess/NetworkProcess.messages.in
M Source/WebKit/Shared/NetworkProcessConnectionParameters.h
M Source/WebKit/Shared/NetworkProcessConnectionParameters.serialization.in
M Source/WebKit/UIProcess/FrameProcess.cpp
M Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.cpp
M Source/WebKit/UIProcess/WebProcessProxy.h
M Source/WebKit/WebProcess/WebPage/WebCookieCache.cpp
M Tools/TestWebKitAPI/PlatformCocoa.cmake
M Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
A Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolationCookieTests.swift
Log Message:
-----------
[Site Isolation] Authorize cookie IPC against the sites a web process hosts
https://bugs.webkit.org/show_bug.cgi?id=322071
rdar://182338424
Reviewed by Richard Robinson.
The cookie handlers in NetworkConnectionToWebProcess validate the firstParty a
web process sends, but the cookies they return are selected by url, which was
never checked. Under site isolation the UI process grants a cross-site iframe's
process the embedding page's domain as an allowed first party, so firstParty is
expected to be cross-origin. A site-isolated iframe could therefore name its
embedder's url and read that site's cookies, HttpOnly ones included, or write
one.
Have the UI process tell the network process which registrable domains each web
process hosts documents for, and require url to name one of them. The set is
tracked on WebProcessProxy: it is the union of the sites the process has
committed under site isolation, kept even after those frames go away because a
document can still touch cookies from an unload handler after its frame moved to
another process. hostedDomains() returns std::nullopt, meaning any site, when
the sites cannot be enumerated: before the process is used for site isolation,
with site isolation off, in single-process mode, for a web archive, and for
remote-worker processes, which are keyed by top site and run third-party
workers.
The check has a single opt-out, taken only by CookieRequestHeaderFieldValue
Digest, whose url is a routinely cross-site subresource. Its reply is a salted
digest, which shows whether url's cookies changed but not their values, and the
memory cache needs it to honor Vary: Cookie for those subresources. Web
Inspector needs no exemption: under site isolation the frontend reads cookies
through the Storage domain in the UI process, and the Page domain's in-process
cookie commands run only with site isolation off, where the check is already
permissive.
DomCookiesForHost now replies std::optional and returns std::nullopt on denial,
so that WebCookieCache does not seed its per-process session from a denied reply
and serve every later read from it.
Tests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolationCookieTests.swift
Cover that a cross-site iframe still reads its own cookies with and
without site isolation, and that the check matches on registrable domain
for a same-site subdomain. The denial itself is not covered by an API
test: the only process that can forge the read is an out-of-process
iframe, and the IPC testing API is injected only into main frames.
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::hostsDomain const):
(WebKit::NetworkConnectionToWebProcess::validateCookieAccess):
(WebKit::NetworkConnectionToWebProcess::cookieRequestHeaderFieldValueDigest):
(WebKit::NetworkConnectionToWebProcess::domCookiesForHost):
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h:
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in:
* Source/WebKit/NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::setHostedDomains):
* Source/WebKit/NetworkProcess/NetworkProcess.h:
* Source/WebKit/NetworkProcess/NetworkProcess.messages.in:
* Source/WebKit/Shared/NetworkProcessConnectionParameters.h:
* Source/WebKit/Shared/NetworkProcessConnectionParameters.serialization.in:
* Source/WebKit/UIProcess/FrameProcess.cpp:
(WebKit::FrameProcess::FrameProcess):
* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::getNetworkProcessConnection):
* Source/WebKit/UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::createForRemoteWorkers):
(WebKit::WebProcessProxy::addSharedProcessDomain):
(WebKit::WebProcessProxy::hostedDomains const):
(WebKit::WebProcessProxy::setMayHostAnySite):
(WebKit::WebProcessProxy::sendHostedDomainsToNetworkProcess):
(WebKit::WebProcessProxy::didStartUsingProcessForSiteIsolation):
* Source/WebKit/UIProcess/WebProcessProxy.h:
* Source/WebKit/WebProcess/WebPage/WebCookieCache.cpp:
(WebKit::WebCookieCache::cookiesForDOM):
* Tools/TestWebKitAPI/PlatformCocoa.cmake:
* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolationCookieTests.swift:
Added.
(SiteIsolationCookieTests.cookieReadingRoutes):
(SiteIsolationCookieTests.setSecureCookie):
(SiteIsolationCookieTests.crossSiteIframeReadsOwnCookies):
(SiteIsolationCookieTests.sameSiteSubdomainIframeReadsOwnCookies):
Canonical link: https://commits.webkit.org/323619@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
