<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - [SOUP] Simplify cookie storage handling"
href="https://bugs.webkit.org/show_bug.cgi?id=166967#c10">Comment # 10</a>
on <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - [SOUP] Simplify cookie storage handling"
href="https://bugs.webkit.org/show_bug.cgi?id=166967">bug 166967</a>
from <span class="vcard"><a class="email" href="mailto:cgarcia@igalia.com" title="Carlos Garcia Campos <cgarcia@igalia.com>"> <span class="fn">Carlos Garcia Campos</span></a>
</span></b>
<pre>(In reply to <a href="show_bug.cgi?id=166967#c9">comment #9</a>)
<span class="quote">> (In reply to <a href="show_bug.cgi?id=166967#c7">comment #7</a>)
> > Note that the default NetworkStorageSession is always created without a
> > SoupNetworkSession, which is specially interesting in the web process
> > because most of the times we don't even need a soup session at all there. If
> > you ask for the cookie storage of the default NetworkStorageSession we don't
> > need to have a default SoupNetworkSession at all, the same way it happens
> > with current code when you call soupCookieJar(). And the only difference in
> > behavior is that now the default SoupNetworkSession is created on demand
> > when asked to the default NetworkStorageSession and the default cookie
> > storage is set in that case, but only stored in NetworkStorageSession (of
> > course the feature is set in the soup session).
>
> OK, that makes sense to me now. The problem I see here is that nothing
> prevents you from accidentally creating a SoupNetworkSession in the web
> process or UI process. Indeed, it seems easier than before because just
> calling NetworkStorageSession::soupNetworkSession has the effect of creating
> a new SoupNetworkSession. Is there some time when a SoupSession really is
> needed in the web process? If so, we should add a FIXME to change that,
> because it prevents future sandboxing. If not, can you add an assertion to
> ensure NetworkStorageSession::soupNetworkSession is only ever called from
> the network process?</span >
Nothing prevents you from calling SoupNetworkSession::defaultSession() from any process. Unfortunately we haven't moved all the network to the network process yet, we still download the appcache manifest in the web process for example. We also use ResourceHandle to downloads fragments of HLS streams.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>