In WebKit1, when authentication is required for a resource, WebKitGtk pops a dialog to ask first even if the browser would like to handle authentication itself. It would be nice if WebKitGtk would have a setting so that the browser could tell WebKitGtk "I got this". Related to Bug #119303 (it looks like if that is implemented, the browser can disable the callstack[1] to here by getting ResourceLoader's m_options.allowCredentials to be != AllowStoredCredentials, but then that calls into WebKitSoupAuthDialogAuthenticationClient::receivedRequestToContinueWithoutCredential which doesn't offer a way for browsers to continue…maybe copying WebKit2's authenticate signal is best here with docs that libsoup's authenticate signal is basically "off limits" to browsers). [1]http://fpaste.org/83480/22816139/
It's unlikely that we'll be adding new API to WebKit1.
Would a patch be accepted if I made one? A lot of the "minimal" browsers are still on WebKit1 (uzbl, surf, luakit, dwb, jumanji (though this seems dead), probably more). I have a plan for uzbl and that might be done by summer, but I don't know about the rest.
They should probably be on the path to porting to WebKit2. At some point we are going to remove WebKit1 entirely.
WebKit1GTK+ has been removed.