LibWeb: Implement Clear-Site-Data HTTP response header #6887
Conversation
| page.client().page_did_set_cookie(url, cookie.value(), Cookie::Source::Http); // FIXME: Determine cookie source correctly | ||
| } | ||
|
|
||
| // https://www.w3.org/TR/clear-site-data/#parsing |
There was a problem hiding this comment.
Could you first make sure your using the editor's draft of this spec?
I.e. https://w3c.github.io/webappsec-clear-site-data/
| void WebContentClient::did_clear_all_cookies(URL::URL url) | ||
| { | ||
| (void)url; | ||
| Application::cookie_jar().expire_cookies_accessed_since(UnixDateTime::from_seconds_since_epoch(0)); |
There was a problem hiding this comment.
I haven't thoroughly looked at this patch, but this caught my eye - I really do not want a single site sending a Clear-Site-Data header to delete all of my cookies.
Imagine github.com sending this header and suddenly you're logged out of youtube.com.
There was a problem hiding this comment.
yep, I understand that. I was trying to stay within scope for this PR (added the fixme noting per origin clearing needed to be implemented). If it's no problem, then I can implement the per origin clearing before resubmitting.
There was a problem hiding this comment.
This should definitely not clear everything; please update the PR to do this per origin instead.
estefysc
force-pushed
the
clear-site-data
branch
from
a4ff190 to
ea81fe9
Compare
|
I am resubmitting with code that clears cookies per origin and with the editor's draft url for the spec. |
github-actions
bot
added
the
conflicts
|
Your pull request has conflicts that need to be resolved before it can be reviewed and merged. Make sure to rebase your branch on top of the latest |
estefysc
force-pushed
the
clear-site-data
branch
from
ea81fe9 to
3a79d60
Compare
github-actions
bot
removed
the
conflicts
Add support for parsing and processing the Clear-Site-Data HTTP response header per W3C specification. This causes the navigation.https.html WPT test to go from timeout to pass.
estefysc
force-pushed
the
clear-site-data
branch
from
3a79d60 to
8718354
Compare
3 participants
Add support for parsing and processing the Clear-Site-Data HTTP response header per W3C specification. This causes the navigation.https.html WPT test to go from timeout to pass.
Implemented:
"cache","cookies","storage","*"directivesNot implemented:
Testing:
WPT test
clear-site-data/navigation.https.htmlpasses via browser runner (./Meta/ladybird.py).