Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 740242c22311be0bb9ac4237000df8d10f326240
https://github.com/WebKit/WebKit/commit/740242c22311be0bb9ac4237000df8d10f326240
Author: Ahmad Saleem <[email protected]>
Date: 2026-09-11 (Fri, 11 Sep 2026)
Changed paths:
M Source/WebCore/platform/network/CredentialStorage.cpp
M Tools/TestWebKitAPI/CMakeLists.txt
M Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
A Tools/TestWebKitAPI/Tests/WebCore/CredentialStorage.cpp
Log Message:
-----------
CredentialStorage::removeCredentialsWithOrigin fails to purge HTTPS
credentials with default port
https://bugs.webkit.org/show_bug.cgi?id=323973
rdar://187210150
Reviewed by Alex Christensen.
removeCredentialsWithOrigin matched the protection space port against a
hardcoded 80 whenever the origin had no explicit port. But a
SecurityOriginData built from a URL has its default port stripped to
std::nullopt in SecurityOrigin::initializeShared(), so an https origin
such as https://example.com has port() == nullopt and fell into the
== 80 branch, which never matches an HTTPS protection space (port 443).
As a result, HTTPS credentials were silently never purged when clearing
website data by origin.
Fall back to the default port for the origin's scheme via
WTF::defaultPortForProtocol() (80 for http, 443 for https) instead of
assuming 80.
Test: Tools/TestWebKitAPI/Tests/WebCore/CredentialStorage.cpp
* Source/WebCore/platform/network/CredentialStorage.cpp:
(WebCore::CredentialStorage::removeCredentialsWithOrigin):
* Tools/TestWebKitAPI/CMakeLists.txt:
* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* Tools/TestWebKitAPI/Tests/WebCore/CredentialStorage.cpp: Added.
(TestWebKitAPI::testCredential):
(TestWebKitAPI::TEST(CredentialStorage,
RemoveCredentialsWithHTTPSOriginDefaultPort)):
(TestWebKitAPI::TEST(CredentialStorage,
RemoveCredentialsWithHTTPOriginDefaultPort)):
(TestWebKitAPI::TEST(CredentialStorage, RemoveCredentialsWithExplicitPort)):
(TestWebKitAPI::TEST(CredentialStorage,
RemoveCredentialsWithOriginDoesNotAffectOtherScheme)):
Canonical link: https://commits.webkit.org/320968@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
