<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - [GTK] "Only from websites I visit" cookie policy is broken"
href="https://bugs.webkit.org/show_bug.cgi?id=168912#c6">Comment # 6</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - [GTK] "Only from websites I visit" cookie policy is broken"
href="https://bugs.webkit.org/show_bug.cgi?id=168912">bug 168912</a>
from <span class="vcard"><a class="email" href="mailto:cgarcia@igalia.com" title="Carlos Garcia Campos <cgarcia@igalia.com>"> <span class="fn">Carlos Garcia Campos</span></a>
</span></b>
<pre>(In reply to <a href="show_bug.cgi?id=168912#c4">comment #4</a>)
<span class="quote">> OK so I finally found the culprit.</span >
\o/ Thanks for investigating this.
<span class="quote">> It's in
> NetworkDataTaskSoup::continuteHTTPRedirection().</span >
No recent regression then . . .
<span class="quote">> I am not sure what's the
> relationship with ResourceHandleSoup but they look pretty much the same.</span >
NetworkDataTask is the new ResourceHandle. The latter is only used in the web process now for the few bits that hasn't been moved to the network process yet.
<span class="quote">> The
> problem is that we're setting the firstPartyForCookies to the URL of the
> redirected message meaning that any redirection will successfully bypass the
> "no third party cookies" policy.</span >
Actually, I think the problem is that we are assuming that all redirections are main resource loads. It's amazing that this problem has always been there!
<span class="quote">> That call is already present in ResourceHandleSoup and has been there for
> ages.</span >
Exactly, this is copied from ResourceHandle.
<span class="quote">> I am almost sure that we can safely remove that call (the cocoa code
> does not do that BTW) as it does not correct. Setting the first party for
> cookies is handled by the FrameLoader and we should not overwrite that.</span >
Right. In case of main resource, DocumentLoader::willSendRequest sets the first party for cookies after the redirection, and in case of subresources, the initial request first party for cookies is copied to the new one, so it's the right one too.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>