Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c876f70514d2e8cd19bfaa93af98204b94b7d579
https://github.com/WebKit/WebKit/commit/c876f70514d2e8cd19bfaa93af98204b94b7d579
Author: Pouneh Bahrami <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-lax-not-sent-cross-site-expected.txt
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-lax-not-sent-cross-site.html
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-none-sent-cross-site-expected.txt
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-none-sent-cross-site.html
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-sent-same-site-expected.txt
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-sent-same-site.html
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-strict-not-sent-cross-site-expected.txt
A
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-strict-not-sent-cross-site.html
M Source/WebKit/NetworkProcess/cocoa/WebSocketTaskCocoa.mm
Log Message:
-----------
WebSocket requests bypass SameSite Strict and Lax Cookies
https://bugs.webkit.org/show_bug.cgi?id=309567
rdar://172188734
Reviewed by Charlie Wolfe.
HTTP requests go through willPerformHTTPRedirection() on each
request/redirect, where updateTaskWithFirstPartyForSameSiteCookies()
sets task._siteForCookies and task._isTopLevelNavigation on the
NSURLSessionTask. This gives CFNetwork the same-site context needed
to filter SameSite=Strict and SameSite=Lax cookies on cross-site
requests.
WebSocket tasks (NSURLSessionWebSocketTask) bypass the
willPerformHTTPRedirection() path entirely. Neither _siteForCookies nor
_isTopLevelNavigation was ever set, so
CFNetwork had no same-site context and attached all matching cookies
regardless of their SameSite attribute.
In WebSocketTask::WebSocketTask(), we call
updateTaskWithFirstPartyForSameSiteCookies()
on the NSURLSessionWebSocketTask immediately after it is created and before
it is resumed. This mirrors the pattern already used for HTTP tasks in
willPerformHTTPRedirection() and for partitioned cookie identifiers in
updateTaskWithStoragePartitionIdentifier().
Tests:
http/tests/websocket/tests/hybi/websocket-samesite-lax-not-sent-cross-site.html
http/tests/websocket/tests/hybi/websocket-samesite-none-sent-cross-site.html
http/tests/websocket/tests/hybi/websocket-samesite-sent-same-site.html
http/tests/websocket/tests/hybi/websocket-samesite-strict-not-sent-cross-site.html
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-lax-not-sent-cross-site-expected.txt:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-lax-not-sent-cross-site.html:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-none-sent-cross-site-expected.txt:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-none-sent-cross-site.html:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-sent-same-site-expected.txt:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-sent-same-site.html:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-strict-not-sent-cross-site-expected.txt:
Added.
*
LayoutTests/http/tests/websocket/tests/hybi/websocket-samesite-strict-not-sent-cross-site.html:
Added.
* Source/WebKit/NetworkProcess/cocoa/WebSocketTaskCocoa.mm:
(WebKit::WebSocketTask::WebSocketTask):
Originally-landed-as: 305413.769@safari-7624-branch (7450aff7426d).
rdar://184744584
Canonical link: https://commits.webkit.org/321109@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
