Skip to content

Navigation Timing: cross-origin redirect opt-in should be based on destination origin. - #66762

Merged
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
yoavweiss:tao_destination_origin
Jul 13, 2026
Merged

Navigation Timing: cross-origin redirect opt-in should be based on destination origin.#66762
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
yoavweiss:tao_destination_origin

Conversation

@yoavweiss

@yoavweiss yoavweiss commented Jun 9, 2026 •
edited by webkit-early-warning-system
Loading

Copy link
Copy Markdown
Contributor

0df60f4

Navigation Timing: cross-origin redirect opt-in should be based on destination origin.
https://bugs.webkit.org/show_bug.cgi?id=316647

Reviewed by Alex Christensen.

This PR aligns the WebKit implementation with whatwg/fetch#1931 and whatwg/html#12513,
and ensures that TAO opt-ins for navigation timing take the destination origin into account.

New iframe tests, plus test progressions.

* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-tao-expected.txt: Progression.
* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-tao.html:
* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/resources/redirect-tao-helper.js:
* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/resources/report-navigation-redirect-timing.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/response-start-after-coop-bcg-switch.https-expected.txt: Expectation change.
* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/unload-event-same-origin-check-expected.txt: Progression.
* Source/WebCore/loader/DocumentLoader.cpp:
(WebCore::hideRedirectTimingForNoReferrerNavigation): Resets redirect count if noreferrer.
(WebCore::DocumentLoader::notifyFinished): Calls hideRedirectTimingForNoReferrerNavigation.
(WebCore::DocumentLoader::commitData): Calls hideRedirectTimingForNoReferrerNavigation.
* Source/WebCore/page/PerformanceNavigationTiming.cpp:
(WebCore::PerformanceNavigationTiming::shouldExposeRedirectTiming const): Only exposes redirect timing if redirectCount is not zero.
(WebCore::PerformanceNavigationTiming::redirectCount const): TAO check.
* Source/WebCore/page/PerformanceNavigationTiming.h:
* Source/WebCore/page/PerformanceResourceTiming.cpp:
(WebCore::fetchStart): Pass exposeRedirectTiming.
(WebCore::entryStartTime): Use shouldExposeRedirectTiming().
(WebCore::PerformanceResourceTiming::shouldExposeRedirectTiming const): A virtual fun that enables NavigationTiming to override the default RT behavior.
(WebCore::PerformanceResourceTiming::redirectStart const): Use shouldExposeRedirectTiming().
(WebCore::PerformanceResourceTiming::redirectEnd const): Use shouldExposeRedirectTiming().
(WebCore::PerformanceResourceTiming::fetchStart const): Use shouldExposeRedirectTiming().
* Source/WebCore/page/PerformanceResourceTiming.h:
* Source/WebCore/platform/network/TimingAllowOrigin.cpp:
(WebCore::passesNavigationTAOCheck):
* Source/WebCore/platform/network/TimingAllowOrigin.h:
* Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp:
(WebKit::NetworkLoadChecker::checkRedirection): Append TAO values.
(WebKit::NetworkLoadChecker::validateResponse): Set TAO values on the response.
(WebKit::NetworkLoadChecker::appendToNavigationTimingAllowValuesList): Accumulate TAO values.
* Source/WebKit/NetworkProcess/NetworkLoadChecker.h:
(WebKit::NetworkLoadChecker::navigationTAOCheckPassed const): Getter.
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::didFinishLoading):

Canonical link: https://commits.webkit.org/317061@main

6559937

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 ❌ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 ios-safer-cpp ✅ 🧪 mac-AS-debug-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 mac-wk2-stress ✅ 🧪 api-gtk
✅ 🛠 🧪 merge ✅ 🛠 vision-sim ✅ 🧪 mac-intel-wk2 ✅ 🛠 playstation
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp
✅ 🛠 tv ✅ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@yoavweiss
yoavweiss requested a review from cdumez as a code owner June 9, 2026 10:36
@yoavweiss yoavweiss self-assigned this Jun 9, 2026
@yoavweiss yoavweiss added the New Bugs Unclassified bugs are placed in this component until the correct component can be determined. label Jun 9, 2026
@webkit-early-warning-system

webkit-early-warning-system commented Jun 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash 90a077f)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2 ❌ 🧪 win-tests
✅ 🧪 webkitperl ❌ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
❌ 🧪 api-ios ❌ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 ios-safer-cpp ❌ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
✅ 🛠 vision ❌ 🧪 mac-wk2-stress ✅ 🧪 api-gtk
✅ 🛠 vision-sim ❌ 🧪 mac-intel-wk2 ✅ 🛠 playstation
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp
✅ 🛠 tv ❌ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@yoavweiss
yoavweiss marked this pull request as draft June 9, 2026 10:37
@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Jun 9, 2026
@yoavweiss yoavweiss removed the merging-blocked Applied to prevent a change from being merged label Jun 21, 2026
@yoavweiss
yoavweiss force-pushed the tao_destination_origin branch from 90a077f to c517be0 Compare June 21, 2026 08:22
@webkit-early-warning-system

webkit-early-warning-system commented Jun 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash c517be0)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2 ❌ 🧪 win-tests
✅ 🧪 webkitperl ❌ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
  🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
  🧪 api-ios ❌ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 ios-safer-cpp ❌ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
✅ 🛠 vision ❌ 🧪 mac-wk2-stress ✅ 🧪 api-gtk
✅ 🛠 vision-sim ❌ 🧪 mac-intel-wk2 ✅ 🛠 playstation
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp
✅ 🛠 tv ❌ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Jun 21, 2026
@yoavweiss yoavweiss mentioned this pull request Jun 23, 2026
Open
@yoavweiss yoavweiss removed the merging-blocked Applied to prevent a change from being merged label Jun 24, 2026
@yoavweiss
yoavweiss force-pushed the tao_destination_origin branch from c517be0 to 4e478b0 Compare June 24, 2026 14:02
@webkit-early-warning-system

webkit-early-warning-system commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash 4e478b0)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2 ❌ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 loading-orange 🧪 api-mac ✅ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
✅ 🧪 api-ios ❌ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 ios-safer-cpp ❌ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 api-gtk
✅ 🛠 vision-sim ❌ 🧪 mac-intel-wk2 ✅ 🛠 playstation
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp
✅ 🛠 tv ❌ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Jun 24, 2026
@yoavweiss yoavweiss removed the merging-blocked Applied to prevent a change from being merged label Jun 26, 2026
@yoavweiss
yoavweiss force-pushed the tao_destination_origin branch from 4e478b0 to 5283d7b Compare June 26, 2026 10:05
@webkit-early-warning-system

webkit-early-warning-system commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash 5283d7b)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2 ❌ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
✅ 🧪 api-ios ❌ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 ios-safer-cpp ❌ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 api-gtk
✅ 🛠 vision-sim ❌ 🧪 mac-intel-wk2 ✅ 🛠 playstation
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp
✅ 🛠 tv ❌ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@yoavweiss
yoavweiss marked this pull request as ready for review June 26, 2026 10:06
@yoavweiss
yoavweiss requested a review from annevk June 26, 2026 10:06
@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Jun 26, 2026
@yoavweiss yoavweiss removed the merging-blocked Applied to prevent a change from being merged label Jun 29, 2026
@yoavweiss
yoavweiss force-pushed the tao_destination_origin branch from 5283d7b to 5146fa2 Compare June 29, 2026 13:47
@yoavweiss
yoavweiss requested a review from a team as a code owner June 29, 2026 13:47
@webkit-early-warning-system

webkit-early-warning-system commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash 5146fa2)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ❌ 🛠 ios ❌ 🛠 mac ❌ 🛠 wpe ❌ 🛠 win
✅ 🧪 bindings ❌ 🛠 ios-sim ❌ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2 ❌ 🧪 win-tests
✅ 🧪 webkitperl ❌ 🧪 ios-wk2 ❌ 🧪 api-mac ❌ 🧪 api-wpe
❌ 🧪 ios-wk2-wpt ❌ 🧪 api-mac-debug ❌ 🛠 gtk3-libwebrtc
❌ 🧪 jsc-x86-64 ❌ 🧪 api-ios ❌ 🧪 mac-wk2 ❌ 🛠 gtk
❌ 🛠 ios-safer-cpp ❌ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
❌ 🛠 vision ❌ 🧪 mac-wk2-stress ❌ 🧪 api-gtk
❌ 🛠 vision-sim ❌ 🧪 mac-intel-wk2 ❌ 🛠 playstation
❌ 🧪 vision-wk2 ❌ 🛠 mac-safer-cpp
❌ 🛠 tv ❌ 🧪 mac-site-isolation
❌ 🛠 tv-sim
❌ 🛠 watch
❌ 🛠 watch-sim

@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Jun 29, 2026
@yoavweiss yoavweiss removed the merging-blocked Applied to prevent a change from being merged label Jun 29, 2026
@yoavweiss
yoavweiss force-pushed the tao_destination_origin branch from 5146fa2 to 16437fa Compare June 29, 2026 15:17
@webkit-early-warning-system

webkit-early-warning-system commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash 16437fa)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2 ⏳ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
  🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
❌ 🧪 api-ios ❌ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 ios-safer-cpp ❌ 🧪 mac-AS-debug-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 api-gtk
✅ 🛠 vision-sim   🧪 mac-intel-wk2 ✅ 🛠 playstation
✅ 🧪 vision-wk2 ❌ 🛠 mac-safer-cpp
✅ 🛠 tv ❌ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@webkit-ews-buildbot

webkit-ews-buildbot commented Jun 29, 2026

Copy link
Copy Markdown
Collaborator

macOS Safer C++ Build #116919 (16437fa)

❌ Found 304 failing files with 230 issues. Please address these issues before landing. See WebKit Guidelines for Safer C++ Programming.
(cc @rniwa)

@webkit-early-warning-system

webkit-early-warning-system commented Jun 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash 212247d)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac   🛠 wpe   🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2   🧪 win-tests
✅ 🧪 webkitperl   🧪 ios-wk2   🧪 api-mac ✅ 🧪 api-wpe
  🧪 ios-wk2-wpt   🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
  🧪 api-ios ❌ 🧪 mac-wk2 ✅ 🛠 gtk
  🛠 ios-safer-cpp   🧪 mac-AS-debug-wk2   🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 api-gtk
✅ 🛠 vision-sim   🧪 mac-intel-wk2 ✅ 🛠 playstation
✅ 🧪 vision-wk2   🛠 mac-safer-cpp
✅ 🛠 tv   🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Jun 30, 2026
@annevk
annevk requested a review from achristensen07 July 1, 2026 14:16
achristensen07
achristensen07 reviewed Jul 6, 2026
View reviewed changes
Comment thread Source/WebCore/platform/network/NetworkLoadMetrics.h Outdated
Comment thread Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp
@@ -237,6 +240,10 @@ ResourceError NetworkLoadChecker::validateResponse(const ResourceRequest& reques
response.setDeprecatedNetworkLoadMetrics(WTF::move(metrics));
}
}

// https://fetch.spec.whatwg.org/#navigation-tao-check
if (m_options.mode == FetchOptions::Mode::Navigate && !response.isRedirection())

@achristensen07 achristensen07 Jul 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are iframe navigations covered in the tests? Would iframe navigations need to TAO the main frame origin or just the origin the iframe is navigating to?

@yoavweiss yoavweiss Jul 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The origin of the iframe it's navigating to, as the top-level origin has no access to the information exposed in the iframe (without active collaboration).

Comment thread Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp Outdated
@achristensen07 achristensen07 mentioned this pull request Jul 6, 2026
Merged
@yoavweiss yoavweiss removed the merging-blocked Applied to prevent a change from being merged label Jul 8, 2026
@yoavweiss
yoavweiss force-pushed the tao_destination_origin branch from 03ff248 to dd03cc3 Compare July 8, 2026 13:16
@webkit-early-warning-system

webkit-early-warning-system commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash dd03cc3)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios   🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 ❌ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ❌ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 ios-safer-cpp ✅ 🧪 mac-AS-debug-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 api-gtk
✅ 🛠 vision-sim ❌ 🧪 mac-intel-wk2 ✅ 🛠 playstation
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp ⏳ 🛠 jsc-armv7
✅ 🛠 tv ✅ 🧪 mac-site-isolation ⏳ 🧪 jsc-armv7-tests
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

achristensen07
achristensen07 requested changes Jul 8, 2026
View reviewed changes
Comment thread Source/WebCore/page/Performance.cpp Outdated
@yoavweiss
yoavweiss force-pushed the tao_destination_origin branch from dd03cc3 to 5d0fda0 Compare July 9, 2026 11:37
@webkit-early-warning-system

webkit-early-warning-system commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash 5d0fda0)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe   🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2   🧪 win-tests
✅ 🧪 webkitperl ❌ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
✅ 🧪 api-ios ❌ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 ios-safer-cpp ❌ 🧪 mac-AS-debug-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 api-gtk
✅ 🛠 vision-sim   🧪 mac-intel-wk2 ✅ 🛠 playstation
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp
✅ 🛠 tv ✅ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Jul 9, 2026
achristensen07
achristensen07 reviewed Jul 9, 2026
View reviewed changes
Comment thread Source/WebCore/page/PerformanceResourceTiming.cpp
@@ -134,7 +141,7 @@ double PerformanceResourceTiming::redirectStart() const

double PerformanceResourceTiming::redirectEnd() const
{
if (m_resourceTiming.networkLoadMetrics().failsTAOCheck)
if (!shouldExposeRedirectTiming())

@achristensen07 achristensen07 Jul 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The shouldExposeRedirectTiming changes look unnecessary now. We already check failsTAOCheck and redirectCount. It seems like the only change needed is adding a redirectCount check in WebCore::fetchStart

@yoavweiss yoavweiss Jul 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems like we don't reset redirectCount for subresources that don't pass TAO check, and doing so is a behavior change for resource timing.

@achristensen07 achristensen07 Jul 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

@yoavweiss yoavweiss removed the merging-blocked Applied to prevent a change from being merged label Jul 10, 2026
@yoavweiss
yoavweiss force-pushed the tao_destination_origin branch from 5d0fda0 to 75e1879 Compare July 10, 2026 10:18
@webkit-early-warning-system

webkit-early-warning-system commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash 75e1879)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ❌ 🧪 wpe-wk2   🧪 win-tests
✅ 🧪 webkitperl ❌ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
✅ 🧪 api-ios ❌ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 ios-safer-cpp ❌ 🧪 mac-AS-debug-wk2 ❌ 🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 mac-wk2-stress ✅ 🧪 api-gtk
✅ 🛠 vision-sim ❌ 🧪 mac-intel-wk2 ✅ 🛠 playstation
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp
✅ 🛠 tv ✅ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Jul 10, 2026
@yoavweiss
yoavweiss requested a review from achristensen07 July 10, 2026 11:17
@yoavweiss yoavweiss removed the merging-blocked Applied to prevent a change from being merged label Jul 11, 2026
@yoavweiss
yoavweiss force-pushed the tao_destination_origin branch from 75e1879 to 6559937 Compare July 11, 2026 05:33
@webkit-early-warning-system

webkit-early-warning-system commented Jul 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on current version of this PR (hash 6559937)

Details

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 ❌ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 ios-safer-cpp ✅ 🧪 mac-AS-debug-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 mac-wk2-stress ✅ 🧪 api-gtk
✅ 🛠 🧪 merge ✅ 🛠 vision-sim ✅ 🧪 mac-intel-wk2 ✅ 🛠 playstation
✅ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp
✅ 🛠 tv ✅ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@yoavweiss yoavweiss added the merge-queue Applied to send a pull request to merge-queue label Jul 13, 2026
@yoavweiss
Navigation Timing: cross-origin redirect opt-in should be based on de…
0df60f4 
…stination origin.

https://bugs.webkit.org/show_bug.cgi?id=316647

Reviewed by Alex Christensen.

This PR aligns the WebKit implementation with whatwg/fetch#1931 and whatwg/html#12513,
and ensures that TAO opt-ins for navigation timing take the destination origin into account.

New iframe tests, plus test progressions.

* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-tao-expected.txt: Progression.
* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-tao.html:
* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/resources/redirect-tao-helper.js:
* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/resources/report-navigation-redirect-timing.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/response-start-after-coop-bcg-switch.https-expected.txt: Expectation change.
* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/unload-event-same-origin-check-expected.txt: Progression.
* Source/WebCore/loader/DocumentLoader.cpp:
(WebCore::hideRedirectTimingForNoReferrerNavigation): Resets redirect count if noreferrer.
(WebCore::DocumentLoader::notifyFinished): Calls hideRedirectTimingForNoReferrerNavigation.
(WebCore::DocumentLoader::commitData): Calls hideRedirectTimingForNoReferrerNavigation.
* Source/WebCore/page/PerformanceNavigationTiming.cpp:
(WebCore::PerformanceNavigationTiming::shouldExposeRedirectTiming const): Only exposes redirect timing if redirectCount is not zero.
(WebCore::PerformanceNavigationTiming::redirectCount const): TAO check.
* Source/WebCore/page/PerformanceNavigationTiming.h:
* Source/WebCore/page/PerformanceResourceTiming.cpp:
(WebCore::fetchStart): Pass exposeRedirectTiming.
(WebCore::entryStartTime): Use shouldExposeRedirectTiming().
(WebCore::PerformanceResourceTiming::shouldExposeRedirectTiming const): A virtual fun that enables NavigationTiming to override the default RT behavior.
(WebCore::PerformanceResourceTiming::redirectStart const): Use shouldExposeRedirectTiming().
(WebCore::PerformanceResourceTiming::redirectEnd const): Use shouldExposeRedirectTiming().
(WebCore::PerformanceResourceTiming::fetchStart const): Use shouldExposeRedirectTiming().
* Source/WebCore/page/PerformanceResourceTiming.h:
* Source/WebCore/platform/network/TimingAllowOrigin.cpp:
(WebCore::passesNavigationTAOCheck):
* Source/WebCore/platform/network/TimingAllowOrigin.h:
* Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp:
(WebKit::NetworkLoadChecker::checkRedirection): Append TAO values.
(WebKit::NetworkLoadChecker::validateResponse): Set TAO values on the response.
(WebKit::NetworkLoadChecker::appendToNavigationTimingAllowValuesList): Accumulate TAO values.
* Source/WebKit/NetworkProcess/NetworkLoadChecker.h:
(WebKit::NetworkLoadChecker::navigationTAOCheckPassed const): Getter.
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::didFinishLoading):

Canonical link: https://commits.webkit.org/317061@main
@webkit-commit-queue

webkit-commit-queue commented Jul 13, 2026

Copy link
Copy Markdown
Collaborator

Committed 317061@main (0df60f4): https://commits.webkit.org/317061@main

Reviewed commits have been landed. Closing PR #66762 and removing active labels.

@webkit-commit-queue
webkit-commit-queue merged commit 0df60f4 into WebKit:main Jul 13, 2026
@webkit-commit-queue webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label Jul 13, 2026
@yoavweiss yoavweiss mentioned this pull request Jul 15, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@achristensen07 achristensen07 achristensen07 approved these changes
@cdumez cdumez Awaiting requested review from cdumez cdumez is a code owner
@annevk annevk Awaiting requested review from annevk

Assignees

@yoavweiss yoavweiss

Labels

New Bugs Unclassified bugs are placed in this component until the correct component can be determined.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@yoavweiss @webkit-early-warning-system @webkit-ews-buildbot @webkit-commit-queue @achristensen07