Timing-Allow-Origin works with 302 #27377

youennf · 2024-04-17T09:02:56Z

`6a2c5a3`

Timing-Allow-Origin works with 302
https://bugs.webkit.org/show_bug.cgi?id=272682
rdar://126531139

Reviewed by Alex Christensen.

We move the TAO check from platform specific NetworkDataTask implementations to NetworkLoadChecker.
This allows us to implement the algorithm as defined in fetch, including checking the response tainting.
This aligns behavior with Chrome and Firefox.
For top level navigation, we were using the source origin, but we should use the top origin for top level navigations,
as top level navigations are same origin.

* LayoutTests/http/wpt/resource-timing/resources/rt-utilities.sub.js:
(addACAOHeader):
* LayoutTests/http/wpt/resource-timing/rt-cors-2-expected.txt: Added.
* LayoutTests/http/wpt/resource-timing/rt-cors-2.html: Added.
* LayoutTests/http/wpt/resource-timing/rt-cors-2.js: Added.
(assertAlways):
(assertRedirectWithDisallowedTimingData):
(assertDisallowedTimingData):
(promise_test):
* Source/WebKit/NetworkProcess/NetworkDataTask.h:
(WebKit::NetworkDataTask::setTimingAllowFailedFlag):
* Source/WebKit/NetworkProcess/NetworkLoad.cpp:
(WebKit::NetworkLoad::setTimingAllowFailedFlag):
* Source/WebKit/NetworkProcess/NetworkLoad.h:
* Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp:
(WebKit::NetworkLoadChecker::validateResponse):
(WebKit::NetworkLoadChecker::checkTAO):
* Source/WebKit/NetworkProcess/NetworkLoadChecker.h:
(WebKit::NetworkLoadChecker::timingAllowFailedFlag const):
(WebKit::NetworkLoadChecker::isSameOriginRequest const):
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::didReceiveResponse):
(WebKit::NetworkResourceLoader::didFinishLoading):
(WebKit::NetworkResourceLoader::willSendRedirectedRequestInternal):
* Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.h:
* Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:
(WebKit::NetworkDataTaskCocoa::setTimingAllowFailedFlag):
(WebKit::NetworkDataTaskCocoa::checkTAO): Deleted.
* Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm:
(-[WKNetworkSessionDelegate URLSession:task:willPerformHTTPRedirection:newRequest:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveResponse:completionHandler:]):
* Source/WebKit/NetworkProcess/curl/NetworkDataTaskCurl.cpp:
(WebKit::NetworkDataTaskCurl::updateNetworkLoadMetrics):
(WebKit::NetworkDataTaskCurl::setTimingAllowFailedFlag):
* Source/WebKit/NetworkProcess/curl/NetworkDataTaskCurl.h:
* Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp:
(WebKit::NetworkDataTaskSoup::didSendRequest):
(WebKit::NetworkDataTaskSoup::setTimingAllowFailedFlag):
* Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.h:

Canonical link: https://commits.webkit.org/278448@main

f3fbc74

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-skia
	~~🧪 api-ios~~	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 tv	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 tv-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
✅ 🛠 🧪 merge	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-early-warning-system · 2024-04-17T09:03:03Z

EWS run on previous version of this PR (hash 8d2b674)

Details

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	~~🛠 wpe~~	✅ 🛠 wincairo
~~🧪 bindings~~	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~
~~🧪 webkitperl~~	~~🧪 ios-wk2~~	⏳ 🧪 api-mac	~~🧪 api-wpe~~
	⏳ 🧪 ios-wk2-wpt	⏳ 🧪 mac-wk1	✅ 🛠 wpe-skia
	⏳ 🧪 api-ios	⏳ 🧪 mac-wk2	~~🛠 gtk~~
	✅ 🛠 tv	~~🧪 mac-AS-debug-wk2~~	~~🧪 gtk-wk2~~
	✅ 🛠 tv-sim	~~🧪 mac-wk2-stress~~	~~🧪 api-gtk~~
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-early-warning-system · 2024-04-17T09:04:43Z

EWS run on previous version of this PR (hash bb2820a)

Details

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	⏳ 🧪 wpe-wk2
✅ 🧪 webkitperl	~~🧪 ios-wk2~~	⏳ 🧪 api-mac	✅ 🧪 api-wpe
	⏳ 🧪 ios-wk2-wpt	⏳ 🧪 mac-wk1	✅ 🛠 wpe-skia
	⏳ 🧪 api-ios	⏳ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 tv	❌ 🧪 mac-AS-debug-wk2	⏳ 🧪 gtk-wk2
	✅ 🛠 tv-sim	⏳ 🧪 mac-wk2-stress	~~🧪 api-gtk~~
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-early-warning-system · 2024-04-17T10:16:42Z

EWS run on previous version of this PR (hash 7a82f69)

Details

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	⏳ 🧪 wpe-wk2
✅ 🧪 webkitperl	❌ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	~~🧪 mac-wk1~~	✅ 🛠 wpe-skia
	✅ 🧪 api-ios	~~🧪 mac-wk2~~	✅ 🛠 gtk
	✅ 🛠 tv	❌ 🧪 mac-AS-debug-wk2	⏳ 🧪 gtk-wk2
	✅ 🛠 tv-sim	❌ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-early-warning-system · 2024-04-17T15:25:54Z

EWS run on previous version of this PR (hash f7cf08f)

Details

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	❌ 🧪 mac-wk1	✅ 🛠 wpe-skia
	✅ 🧪 api-ios	❌ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 tv	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 tv-sim	❌ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-early-warning-system · 2024-04-18T08:52:54Z

EWS run on previous version of this PR (hash c917638)

Details

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	❌ 🧪 mac-wk1	✅ 🛠 wpe-skia
	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 tv	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 tv-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
❌ 🛠 🧪 merge	✅ 🛠 watch
	✅ 🛠 watch-sim

Source/WebKit/NetworkProcess/NetworkDataTask.h

Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp

webkit-commit-queue · 2024-04-30T09:02:55Z

Failed to access https://raw.githubusercontent.com/WebKit/WebKit/main/metadata/contributors.json, blocking PR #27377

webkit-early-warning-system · 2024-05-06T07:26:55Z

EWS run on previous version of this PR (hash a33cba1)

Details

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-skia
	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 tv	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 tv-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
❌ 🛠 🧪 merge	✅ 🛠 watch
	✅ 🛠 watch-sim

webkit-early-warning-system · 2024-05-07T08:18:08Z

EWS run on current version of this PR (hash f3fbc74)

Details

Misc	iOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-skia
	~~🧪 api-ios~~	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 tv	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 tv-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
✅ 🛠 🧪 merge	✅ 🛠 watch
	✅ 🛠 watch-sim

https://bugs.webkit.org/show_bug.cgi?id=272682 rdar://126531139 Reviewed by Alex Christensen. We move the TAO check from platform specific NetworkDataTask implementations to NetworkLoadChecker. This allows us to implement the algorithm as defined in fetch, including checking the response tainting. This aligns behavior with Chrome and Firefox. For top level navigation, we were using the source origin, but we should use the top origin for top level navigations, as top level navigations are same origin. * LayoutTests/http/wpt/resource-timing/resources/rt-utilities.sub.js: (addACAOHeader): * LayoutTests/http/wpt/resource-timing/rt-cors-2-expected.txt: Added. * LayoutTests/http/wpt/resource-timing/rt-cors-2.html: Added. * LayoutTests/http/wpt/resource-timing/rt-cors-2.js: Added. (assertAlways): (assertRedirectWithDisallowedTimingData): (assertDisallowedTimingData): (promise_test): * Source/WebKit/NetworkProcess/NetworkDataTask.h: (WebKit::NetworkDataTask::setTimingAllowFailedFlag): * Source/WebKit/NetworkProcess/NetworkLoad.cpp: (WebKit::NetworkLoad::setTimingAllowFailedFlag): * Source/WebKit/NetworkProcess/NetworkLoad.h: * Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp: (WebKit::NetworkLoadChecker::validateResponse): (WebKit::NetworkLoadChecker::checkTAO): * Source/WebKit/NetworkProcess/NetworkLoadChecker.h: (WebKit::NetworkLoadChecker::timingAllowFailedFlag const): (WebKit::NetworkLoadChecker::isSameOriginRequest const): * Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp: (WebKit::NetworkResourceLoader::didReceiveResponse): (WebKit::NetworkResourceLoader::didFinishLoading): (WebKit::NetworkResourceLoader::willSendRedirectedRequestInternal): * Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.h: * Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm: (WebKit::NetworkDataTaskCocoa::setTimingAllowFailedFlag): (WebKit::NetworkDataTaskCocoa::checkTAO): Deleted. * Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm: (-[WKNetworkSessionDelegate URLSession:task:willPerformHTTPRedirection:newRequest:completionHandler:]): (-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveResponse:completionHandler:]): * Source/WebKit/NetworkProcess/curl/NetworkDataTaskCurl.cpp: (WebKit::NetworkDataTaskCurl::updateNetworkLoadMetrics): (WebKit::NetworkDataTaskCurl::setTimingAllowFailedFlag): * Source/WebKit/NetworkProcess/curl/NetworkDataTaskCurl.h: * Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp: (WebKit::NetworkDataTaskSoup::didSendRequest): (WebKit::NetworkDataTaskSoup::setTimingAllowFailedFlag): * Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.h: Canonical link: https://commits.webkit.org/278448@main

webkit-commit-queue · 2024-05-07T10:17:51Z

Committed 278448@main (6a2c5a3): https://commits.webkit.org/278448@main

Reviewed commits have been landed. Closing PR #27377 and removing active labels.

youennf requested review from a team and cdumez as code owners April 17, 2024 09:02

youennf self-assigned this Apr 17, 2024

youennf added the Page Loading For bugs in page loading, including handling of network callbacks. label Apr 17, 2024

youennf force-pushed the eng/Timing-Allow-Origin-works-with-302 branch from 8d2b674 to bb2820a Compare April 17, 2024 09:04

youennf marked this pull request as draft April 17, 2024 10:00

youennf force-pushed the eng/Timing-Allow-Origin-works-with-302 branch from bb2820a to 7a82f69 Compare April 17, 2024 10:16

webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Apr 17, 2024

youennf force-pushed the eng/Timing-Allow-Origin-works-with-302 branch from 7a82f69 to f7cf08f Compare April 17, 2024 15:25

youennf force-pushed the eng/Timing-Allow-Origin-works-with-302 branch from f7cf08f to c917638 Compare April 18, 2024 08:52

youennf marked this pull request as ready for review April 18, 2024 12:07

youennf requested a review from achristensen07 April 18, 2024 12:08

youennf removed the merging-blocked Applied to prevent a change from being merged label Apr 18, 2024

webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Apr 18, 2024

youennf removed the merging-blocked Applied to prevent a change from being merged label Apr 19, 2024

achristensen07 approved these changes Apr 19, 2024

View reviewed changes

Source/WebKit/NetworkProcess/NetworkDataTask.h Outdated Show resolved Hide resolved

Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp Outdated Show resolved Hide resolved

youennf added the merge-queue Applied to send a pull request to merge-queue label Apr 30, 2024

webkit-commit-queue added merging-blocked Applied to prevent a change from being merged and removed merge-queue Applied to send a pull request to merge-queue labels Apr 30, 2024

youennf force-pushed the eng/Timing-Allow-Origin-works-with-302 branch from c917638 to a33cba1 Compare May 6, 2024 07:26

youennf added merge-queue Applied to send a pull request to merge-queue and removed merging-blocked Applied to prevent a change from being merged labels May 7, 2024

youennf force-pushed the eng/Timing-Allow-Origin-works-with-302 branch from a33cba1 to f3fbc74 Compare May 7, 2024 08:18

youennf added merge-queue Applied to send a pull request to merge-queue and removed merge-queue Applied to send a pull request to merge-queue labels May 7, 2024

webkit-commit-queue force-pushed the eng/Timing-Allow-Origin-works-with-302 branch from f3fbc74 to c8a9eee Compare May 7, 2024 10:15

webkit-commit-queue force-pushed the eng/Timing-Allow-Origin-works-with-302 branch from c8a9eee to 6a2c5a3 Compare May 7, 2024 10:17

webkit-commit-queue merged commit 6a2c5a3 into WebKit:main May 7, 2024

webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label May 7, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Timing-Allow-Origin works with 302 #27377

Timing-Allow-Origin works with 302 #27377

Uh oh!

youennf commented Apr 17, 2024 •

edited by webkit-early-warning-system

Loading

Uh oh!

webkit-early-warning-system commented Apr 17, 2024 •

edited

Loading

Uh oh!

webkit-early-warning-system commented Apr 17, 2024 •

edited

Loading

Uh oh!

webkit-early-warning-system commented Apr 17, 2024 •

edited

Loading

Uh oh!

webkit-early-warning-system commented Apr 17, 2024 •

edited

Loading

Uh oh!

webkit-early-warning-system commented Apr 18, 2024 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

webkit-commit-queue commented Apr 30, 2024

Uh oh!

webkit-early-warning-system commented May 6, 2024 •

edited

Loading

Uh oh!

webkit-early-warning-system commented May 7, 2024 •

edited

Loading

Uh oh!

webkit-commit-queue commented May 7, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Timing-Allow-Origin works with 302 #27377

Timing-Allow-Origin works with 302 #27377

Uh oh!

Conversation

youennf commented Apr 17, 2024 • edited by webkit-early-warning-system Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

6a2c5a3

Uh oh!

webkit-early-warning-system commented Apr 17, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented Apr 17, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented Apr 17, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented Apr 17, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented Apr 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

webkit-commit-queue commented Apr 30, 2024

Uh oh!

webkit-early-warning-system commented May 6, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-early-warning-system commented May 7, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webkit-commit-queue commented May 7, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

youennf commented Apr 17, 2024 •

edited by webkit-early-warning-system

Loading

`6a2c5a3`

webkit-early-warning-system commented Apr 17, 2024 •

edited

Loading

webkit-early-warning-system commented Apr 17, 2024 •

edited

Loading

webkit-early-warning-system commented Apr 17, 2024 •

edited

Loading

webkit-early-warning-system commented Apr 17, 2024 •

edited

Loading

webkit-early-warning-system commented Apr 18, 2024 •

edited

Loading

webkit-early-warning-system commented May 6, 2024 •

edited

Loading

webkit-early-warning-system commented May 7, 2024 •

edited

Loading