<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:mario@webkit.org" title="Mario Sanchez Prada <mario@webkit.org>"> <span class="fn">Mario Sanchez Prada</span></a>
</span> changed
<a class="bz_bug_link
bz_status_REOPENED "
title="REOPENED - [WK2][GTK] Expose the enable-web-security property in WebKit2GTK API"
href="https://bugs.webkit.org/show_bug.cgi?id=130398">bug 130398</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Status</td>
<td>RESOLVED
</td>
<td>REOPENED
</td>
</tr>
<tr>
<td style="text-align:right;">Resolution</td>
<td>WONTFIX
</td>
<td>---
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_REOPENED "
title="REOPENED - [WK2][GTK] Expose the enable-web-security property in WebKit2GTK API"
href="https://bugs.webkit.org/show_bug.cgi?id=130398#c17">Comment # 17</a>
on <a class="bz_bug_link
bz_status_REOPENED "
title="REOPENED - [WK2][GTK] Expose the enable-web-security property in WebKit2GTK API"
href="https://bugs.webkit.org/show_bug.cgi?id=130398">bug 130398</a>
from <span class="vcard"><a class="email" href="mailto:mario@webkit.org" title="Mario Sanchez Prada <mario@webkit.org>"> <span class="fn">Mario Sanchez Prada</span></a>
</span></b>
<pre>(In reply to <a href="show_bug.cgi?id=130398#c16">comment #16</a>)
<span class="quote">> Let's say we'd like to write an local application written in HTML that runs
> within WebKit, what would be the solution if not this API to let the local
> application load resources from the web ?</span >
After more than one year with this thing buried i nthe bugzilla, I recently stumbled into a situation quite similar to the one described by Nicolas, where the only way I could move forward was by disabling web-security.
To be clear, this happens in a context where I'm sure disabling this option does not pose any problem (i.e. not a full fledged browser), and where we control all the local content being loaded by the webview, meaning that there's no way anyone could inject a XSS attack or anything, pretty much like the case for testing the CSS test suite mentioned initially along with this bug report.
So, I'd like to get this discussion back to life again, see if we can agree on adding this property to the public API, so that embedders of WebKitGTK can use it if needed, without needing downstream patches.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>