WKUIDelegate should provide a hook for page-specific location prompts

• Component: WebKit2
• Status: NEW ---

[Eugene But]

Summary:
The WKUIDelegate methods for alerts are very useful, as it finally allows a non-hacky way of doing things like off-screen rendering (e.g., for pre-rendering a page). However, a page can still throw a page-specific location permission prompt without any hook, which means a page the user can't see might prompt them.

For all the same reasons that the alert delegation exists, WKUIDelegate should also have a hook of some kind for controlling whether to show location permission prompts from individual pages.

Steps to Reproduce:
1) Make a WKWebView that shouldn't display any prompts (e.g., because it's offscreen).
2) Navigate it to maps.google.com

Expected Results:
A location prompt that can't be prevented/handled in native code.

Actual Results:
Making the following WKUIDelegateMethod public is perfect solution for us:
+- (bool)_webView:(WKWebView *)webView shouldRequestGeolocationAuthorizationForURL:(NSURL *)url isMainFrame:(BOOL)isMainFrame mainFrameURL:(NSURL *)mainFrameURL;

[Eugene But]

Radar ID: 17486671

[Stefan Arentz]

+1 This would be wonderful to have for Firefox for iOS.

[Stuart Morgan]

Note that this is a security issue, as described in rdar://21289208

[ANDY]

Created attachment 462540 [details]
123

[Stefan Arentz]

The attachment that just was posted got my hopes up but unfortunately it is spam or maybe something malicious. Beware.

[Darryl Pogue]

The newer version of this API would be WKUIDelegate's private `_webView:requestGeolocationPermissionForOrigin:initiatedByFrame:decisionHandler:` SPI method.

- (void)_webView:(WKWebView *)webView requestGeolocationPermissionForOrigin:(WKSecurityOrigin*)origin initiatedByFrame:(WKFrameInfo *)frame decisionHandler:(void (^)(WKPermissionDecision decision))decisionHandler WK_API_AVAILABLE(macos(12.0), ios(15.0));

This matches the similar API methods publicly available on WKUIDelegate for handling media capture and device orientation permission prompts.

[Darryl Pogue]

Since this involves public API, I've also submitted it through Feedback Assistant as FB13756330