Bug 232730

Summary: Deprecate _allowTLSCertificateChain:forHost:
Product: WebKit Reporter: Alex Christensen <achristensen>
Component: New BugsAssignee: Alex Christensen <achristensen>
Status: NEW    
Severity: Normal CC: berto, cgarcia, ews-watchlist, gustavo, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
ews-feeder: commit-queue-
Patch achristensen: review?

Alex Christensen
Reported 2021-11-04 15:48:27 PDT
Deprecate _allowTLSCertificateChain:forHost:
Attachments
Patch (13.85 KB, patch)
2021-11-04 15:50 PDT, Alex Christensen 		ews-feeder: commit-queue-
DetailsFormatted DiffDiff
Patch (18.17 KB, patch)
2021-11-04 16:49 PDT, Alex Christensen 		achristensen: review?
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Alex Christensen
Comment 1 2021-11-04 15:50:15 PDT
Created attachment 443346 [details] Patch
Alex Christensen
Comment 2 2021-11-04 16:49:18 PDT
Created attachment 443355 [details] Patch
Alex Christensen
Comment 3 2021-11-04 16:50:08 PDT
It seems like this has been baked into the GTK API. Can that be removed? Is there a challenge-based way to allow invalid certs in the GTK API like WKNavigationDelegate.didReceiveAuthenticationChallenge?
EWS Watchlist
Comment 4 2021-11-04 16:50:27 PDT
Thanks for the patch. If this patch contains new public API please make sure it follows the guidelines for new WebKit2 GTK+ API. See https://trac.webkit.org/wiki/WebKitGTK/AddingNewWebKit2API
Carlos Garcia Campos
Comment 5 2021-11-05 00:00:25 PDT
This is used by apps to allow an invalid certificate when the user accepts the risks. We don't have alternative API for this, but even in that case we would need to keep the old api working for backwards compatibility.
Alex Christensen
Comment 6 2021-11-05 11:01:31 PDT
Does libsoup have an API that asks at the time of TLS handshake whether the certificate chain should be accepted or not?
Alex Christensen
Comment 7 2021-11-05 11:04:57 PDT
Does tlsConnectionAcceptCertificateCallback have to return a bool immediately, or is there an asynchronous version that can ask the UI process? That's what WebKit does on Cocoa platforms.
Carlos Garcia Campos
Comment 8 2021-11-06 01:03:47 PDT
Yes, the API is synchronous, because the GLib API for that is synchronous too. So we need to make the load fail first, tell the user about it with the button to try again on their own risk and load again after providing the tls certificate as an exception to be allowed.
Radar WebKit Bug Importer
Comment 9 2021-11-11 14:49:20 PST
<rdar://problem/85316802>
Note You need to log in before you can comment on or make changes to this bug.