Bug 286922

Summary:

WKWebView opens opens a TLS connection before calling decidePolicyForNavigationAction (and despite it returning WKNavigationActionPolicyCancel)

Product:

WebKit

Reporter:

Jeff Johnson <opendarwin>

Component:

WebKit API

Assignee:

Nobody <webkit-unassigned>

Status:

NEW

Severity:

Normal

CC:

achristensen, beidson, cdumez, ggaren, m_finkel, webkit-bug-importer, wilander

Priority:

Keywords:

InRadar

Version:

Safari 18

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Sample Xcode project	none
Screenshot showing the WebKit Networking process connecting to https://example.org	none

Jeff Johnson

Reported 2025-02-03 07:05:58 PST

Created attachment 474122 [details] Sample Xcode project WKWebView opens https links before the WKNavigationDelegate method webView:decidePolicyForNavigationAction:decisionHandler: is called, even with WKNavigationActionPolicyCancel. Attached is a sample Xcode project demonstrating the bug. It calls decisionHandler(WKNavigationActionPolicyCancel) for all WKNavigationTypeLinkActivated navigation actions. If you click the http: link, then it simply cancels as expected. Whereas if you click the https: link, it attempts to connect to the linked URL before decidePolicyForNavigationAction: is called. This can be verified with a firewall such as Little Snitch or a packet trace.

Attachments
Sample Xcode project (13.84 KB, application/zip) 2025-02-03 07:05 PST, Jeff Johnson	no flags	Details
Screenshot showing the WebKit Networking process connecting to https://example.org (228.11 KB, image/png) 2025-02-03 07:06 PST, Jeff Johnson	no flags	Details
View All Add attachment proposed patch, testcase, etc.

Jeff Johnson

Comment 1 2025-02-03 07:06:53 PST

Created attachment 474123 [details] Screenshot showing the WebKit Networking process connecting to https://example.org

Radar WebKit Bug Importer

Comment 2 2025-02-10 07:06:27 PST

<rdar://problem/144527847>

Geoffrey Garen

Comment 3 2025-02-24 12:44:42 PST

I think the word "link" may be ambiguous here. Do you mean that the WebView follows an HTML anchor link navigation, and renders the webpage? Or do you mean that the WebView opens a TLS connection (but does not follows any HTML anchor link navigation, or render any webpage)?

Jeff Johnson

Comment 4 2025-02-24 13:10:14 PST

I mean that the WebView opens a TLS connection. If it rendered the webpage, then you wouldn't need a packet trace or the like to verify the bug.

Note You need to log in before you can comment on or make changes to this bug.