Bug 113159 – Use session persistence in ResourceHandle::didReceiveAuthenticationChallenge() in CFNetwork loader to match Foundation one

• Status: NEW
• Component: Platform

[Pratik Solanki]

Looking at ResourceHandle::didReceiveAuthenticationChallenge() implementation, I see

ResourceHandleMac.mm

    if (!d->m_user.isNull() && !d->m_pass.isNull()) {
        NSURLCredential *credential = [[NSURLCredential alloc] initWithUser:d->m_user
                                                                   password:d->m_pass
                                                                persistence:NSURLCredentialPersistenceForSession];
       ...
    }

And ResourceHandleCFNet.cpp has

    if (!d->m_user.isNull() && !d->m_pass.isNull()) {
        RetainPtr<CFURLCredentialRef> credential = adoptCF(CFURLCredentialCreate(kCFAllocatorDefault, d->m_user.createCFString().get(), d->m_pass.createCFString().get(), 0, kCFURLCredentialPersistenceNone));
        
        ...
    }

Note that we use NSURLCredentialPersistenceForSession in one and kCFURLCredentialPersistenceNone in the other. The CFNetwork loader should use session persistence.

[Pratik Solanki]

Created attachment 194770 [details]
Patch

[Alexey Proskuryakov]

Comment on attachment 194770 [details]
Patch

This is super confusing, but I think that they actually match now. The reason is that Mac version calls ResourceHandle::receivedCredential, which changes persistence to None, while CFNet calls CFURLConnectionUseCredential directly.

[Pratik Solanki]

You're right. It will set it to none. Should we call receivedCredential() in ResourceHandleCFNet.cpp?

[Alexey Proskuryakov]

The credentials code is not quite parallel between Mac and CFNet versions, because APIs are different.

Generally, we obviously want the code to be as similar as possible, and ideally shared. I do not remember if there was a specific reason why these parts had be be different.

[Alexey Proskuryakov]

Also, the idea behind Mac code is that setting persistence to None is an implementation detail of how CredentialStorage works, as semantically it's still session persistence.

Eventually we'll remove CredentialStorage completely (probably by using a separate storage session for cross-origin requests).