Skip to content

[GLib] Service worker script updates are sent without cookies - #78216

Open
dangowrt wants to merge 1 commit into
WebKit:mainfrom
dangowrt:eng/serviceworker-samesite-cookies
Open

[GLib] Service worker script updates are sent without cookies#78216
dangowrt wants to merge 1 commit into
WebKit:mainfrom
dangowrt:eng/serviceworker-samesite-cookies

Conversation

@dangowrt

@dangowrt dangowrt commented Oct 25, 2026 •
edited by webkit-early-warning-system
Loading

Copy link
Copy Markdown
Contributor

7f78954

[GLib] Service worker script updates are sent without cookies
https://bugs.webkit.org/show_bug.cgi?id=328830

Reviewed by NOBODY (OOPS!).

SWServer::createScriptRequest() sets the first party for cookies but
leaves the request's same-site flag unspecified. On the libsoup ports
ResourceRequest::createSoupMessage() then sets no site for cookies, so
libsoup treats the soft update fetch of a service worker script as
cross-site and attaches no SameSite=Lax or SameSite=Strict cookie. A
site that answers such a request with fresh session cookies, as Netflix
does, logs the user out on every navigation that triggers a soft update.

Mark the request same-site when the script URL and the top origin share
a registrable domain.

* Source/WebCore/workers/service/server/SWServer.cpp:
(WebCore::SWServer::createScriptRequest):

7f78954

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-cmake-debug ❌ 🧪 wpe-wk2 ✅ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
⏳ 🧪 webkitpy ✅ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-cmake-debug
✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk3-gcc
⏳ 🛠 🧪 jsc-debug-arm64 ✅ 🛠 ios-safer-cpp ✅ 🧪 mac-cmake-debug-wk2 ✅ 🛠 gtk
⏳ 🧪 services ✅ 🛠 vision ❌ 🧪 gtk-wk2
✅ 🛠 vision-sim ✅ 🧪 mac-intel-wk2 ✅ 🧪 api-gtk
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp   🛠 playstation
✅ 🛠 tv ✅ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@dangowrt
[GLib] Service worker script updates are sent without cookies
7f78954 
https://bugs.webkit.org/show_bug.cgi?id=328830

Reviewed by NOBODY (OOPS!).

SWServer::createScriptRequest() sets the first party for cookies but
leaves the request's same-site flag unspecified. On the libsoup ports
ResourceRequest::createSoupMessage() then sets no site for cookies, so
libsoup treats the soft update fetch of a service worker script as
cross-site and attaches no SameSite=Lax or SameSite=Strict cookie. A
site that answers such a request with fresh session cookies, as Netflix
does, logs the user out on every navigation that triggers a soft update.

Mark the request same-site when the script URL and the top origin share
a registrable domain.

* Source/WebCore/workers/service/server/SWServer.cpp:
(WebCore::SWServer::createScriptRequest):
@webkit-early-warning-system

webkit-early-warning-system commented Oct 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on current version of this PR (hash 7f78954)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-cmake-debug ❌ 🧪 wpe-wk2 ✅ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
⏳ 🧪 webkitpy ✅ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-cmake-debug
✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk3-gcc
⏳ 🛠 🧪 jsc-debug-arm64 ✅ 🛠 ios-safer-cpp ✅ 🧪 mac-cmake-debug-wk2 ✅ 🛠 gtk
⏳ 🧪 services ✅ 🛠 vision ❌ 🧪 gtk-wk2
✅ 🛠 vision-sim ✅ 🧪 mac-intel-wk2 ✅ 🧪 api-gtk
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp   🛠 playstation
✅ 🛠 tv ✅ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@dangowrt
dangowrt marked this pull request as ready for review October 25, 2026 10:09
@dangowrt
dangowrt requested a review from cdumez as a code owner October 25, 2026 10:09
@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Oct 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cdumez cdumez Awaiting requested review from cdumez cdumez is a code owner

Assignees

No one assigned

Labels

merging-blocked Applied to prevent a change from being merged

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@dangowrt @webkit-early-warning-system @webkit-ews-buildbot