Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ee54ef0cddb03af6ebea7c38c2f2fdab1f1dd30d
https://github.com/WebKit/WebKit/commit/ee54ef0cddb03af6ebea7c38c2f2fdab1f1dd30d
Author: Charlie Wolfe <[email protected]>
Date: 2026-07-31 (Fri, 31 Jul 2026)
Changed paths:
A
LayoutTests/http/tests/resourceLoadStatistics/cname-cloaking-top-level-navigation-not-capped.https-expected.txt
A
LayoutTests/http/tests/resourceLoadStatistics/cname-cloaking-top-level-navigation-not-capped.https.html
M Source/WebKit/NetworkProcess/cocoa/NetworkTaskCocoa.mm
Log Message:
-----------
REGRESSION(288096@main): ITP may cap the expiry of cookies set by a top-level
navigation's own response
https://bugs.webkit.org/show_bug.cgi?id=320690
rdar://183664485
Reviewed by Matthew Finkel.
Third-party CNAME and IP-address cloaking are defined in terms of first-party
subresources, but
288096@main dropped the top-level navigation exemption and now installs the
cookie transform for
every first-party request. As a result, a site whose own hostname is CNAMEd
across registrable
domains has cookies set by its own top-level response capped to 7 days.
Restore the exemption inside setCookieTransformForFirstPartyRequest().
Test:
http/tests/resourceLoadStatistics/cname-cloaking-top-level-navigation-not-capped.https.html
*
LayoutTests/http/tests/resourceLoadStatistics/cname-cloaking-top-level-navigation-not-capped.https-expected.txt:
Added.
*
LayoutTests/http/tests/resourceLoadStatistics/cname-cloaking-top-level-navigation-not-capped.https.html:
Added.
* Source/WebKit/NetworkProcess/cocoa/NetworkTaskCocoa.mm:
(WebKit::NetworkTaskCocoa::setCookieTransformForFirstPartyRequest):
Canonical link: https://commits.webkit.org/318332@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
