Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 479edb2e4395baaa1f7bec9655aacf4b24a611a6
https://github.com/WebKit/WebKit/commit/479edb2e4395baaa1f7bec9655aacf4b24a611a6
Author: Qianlang Chen <[email protected]>
Date: 2026-07-27 (Mon, 27 Jul 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-serialized-certificate-expected.txt
A
LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-serialized-certificate.html
A
LayoutTests/http/tests/site-isolation/inspector/network/resources/get-serialized-certificate-iframe.html
M Source/JavaScriptCore/inspector/protocol/Network.json
M Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp
M Source/WebCore/inspector/agents/InspectorNetworkAgent.h
M Source/WebInspectorUI/UserInterface/Models/Resource.js
M Source/WebKit/UIProcess/Inspector/Agents/ProxyingNetworkAgent.cpp
M Source/WebKit/UIProcess/Inspector/Agents/ProxyingNetworkAgent.h
M Source/WebKit/WebProcess/Inspector/BackendResourceDataStore.cpp
M Source/WebKit/WebProcess/Inspector/BackendResourceDataStore.h
M Source/WebKit/WebProcess/Inspector/WebInspectorBackend.cpp
M Source/WebKit/WebProcess/Inspector/WebInspectorBackend.h
M Source/WebKit/WebProcess/Inspector/WebInspectorBackend.messages.in
Log Message:
-----------
[Site Isolation] Web Inspector: Implement Network.getSerializedCertificate
https://bugs.webkit.org/show_bug.cgi?id=319020
rdar://181636486
Reviewed by BJ Burg.
Under Site Isolation the Network domain is served by ProxyingNetworkAgent
in the UIProcess, which routes each requestId-keyed command to the
WebContent process that performed the load. A resource's TLS certificate
has to follow that path: it lives on the ResourceResponse in the loading
process and is not retained afterwards, so it is captured at response
time into the same per-process store that already backs getResponseBody.
That buffering already existed but sat behind a store setting that was
never turned on. We drive the setting from the inspected page's existing
certificate-display preference rather than forcing it on, so Site
Isolation makes the same embedder- and platform-gated decision as the
non-Site-Isolation path instead of quietly diverging from it. It is
applied when network instrumentation is enabled -- the point where the
page is known to be live and where the other network overrides are
already latched.
The protocol command was synchronous. Serving it that way would mean a
synchronous UIProcess-to-WebContent IPC, which blocks the UIProcess on a
web content process and would require teaching WebPage to forward
synchronous messages to its inspector receiver. Making the command
asynchronous instead lets it reuse the getResponseBody routing and adds
no new IPC plumbing; the shared requestId-to-process resolution is
factored into a helper. The tradeoff is converting the shared WebCore
handler that every non-Site-Isolation port implements from a synchronous
return to a callback; that is mechanical and invisible to the frontend,
which already awaits the command.
Neither shared-code change moves the non-Site-Isolation path: the page
target's handler still completes synchronously in place (only its return
shape changed, not its timing), and the frontend's backend-target
reroute is gated on a flag set only under Site Isolation.
Two caveats shared with getResponseBody: the command must be declared
on the web-page target or it is absent from the backend dispatcher
where ProxyingNetworkAgent lives, and the frontend must issue it
against the backend target, since a resource's own target is the page
target that cannot resolve the requestId under Site Isolation.
A real certificate requires a TLS load, so the test drives the success
path through a cross-origin https iframe and covers the
missing-certificate, malformed-requestId, and unknown-process routing
paths without one.
Test:
http/tests/site-isolation/inspector/network/cross-origin-iframe-get-serialized-certificate.html
*
LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-serialized-certificate-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-serialized-certificate.html:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/network/resources/get-serialized-certificate-iframe.html:
Added.
* Source/JavaScriptCore/inspector/protocol/Network.json:
* Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp:
(WebCore::InspectorNetworkAgent::getSerializedCertificate):
* Source/WebCore/inspector/agents/InspectorNetworkAgent.h:
* Source/WebInspectorUI/UserInterface/Models/Resource.js:
(WI.Resource.prototype.async showCertificate):
* Source/WebKit/UIProcess/Inspector/Agents/ProxyingNetworkAgent.cpp:
(Inspector::replyFailureString):
(Inspector::resolveRequestProcess):
(Inspector::ProxyingNetworkAgent::getResponseBody):
(Inspector::ProxyingNetworkAgent::getSerializedCertificate):
* Source/WebKit/UIProcess/Inspector/Agents/ProxyingNetworkAgent.h:
* Source/WebKit/WebProcess/Inspector/BackendResourceDataStore.cpp:
(WebKit::BackendResourceDataStore::getSerializedCertificate):
* Source/WebKit/WebProcess/Inspector/BackendResourceDataStore.h:
(WebKit::BackendResourceDataStore::setSupportsShowingCertificate):
* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.cpp:
(WebKit::WebInspectorBackend::enableNetworkInstrumentation):
(WebKit::WebInspectorBackend::getSerializedCertificate):
* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.h:
* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.messages.in:
Canonical link: https://commits.webkit.org/317989@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
