Bug 138843 - REGRESSION (r158036): WebView cannot handle HTTP Basic Authentication challenge
Summary: REGRESSION (r158036): WebView cannot handle HTTP Basic Authentication challenge
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.10
: P2 Normal
Assignee: Alexey Proskuryakov
Keywords: InRadar
Depends on:
Reported: 2014-11-18 13:31 PST by awee
Modified: 2014-12-08 23:26 PST (History)
6 users (show)

See Also:

Test application that demonstrates issue. (84.31 KB, application/zip)
2014-11-18 13:31 PST, awee
no flags Details
proposed fix (2.32 KB, patch)
2014-12-08 15:47 PST, Alexey Proskuryakov
no flags Details | Formatted Diff | Diff
proposed fix (2.31 KB, patch)
2014-12-08 17:20 PST, Alexey Proskuryakov
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description awee 2014-11-18 13:31:20 PST
Created attachment 241808 [details]
Test application that demonstrates issue.

When a WebView encounters an http authentication challenge, it will show the WebAuthenticationPanel as a sheet, but after the user clicks cancel or Log in, no further web requests are sent or received with regards to the challenge.

After debugging the WebKit sources, it looks like the WebAuthenticationPanel, which handles prompting the user for credentials for HTTP authentication challenges, is currently calling [panel close] in its cancel/login button handlers before trying to call endSheet on panel.sheetParent (line 78 and 98 of https://trac.webkit.org/browser/trunk/Source/WebKit/mac/Panels/WebAuthenticationPanel.m?annotate=blame&rev=158036). While is this works on OSX 10.9, it looks like on OSX 10.10 (Yosemite) the call to [panel close] causes panel.sheetParent to become nil, which prevents the callback from being executed and the authentication challenge is never responded to.

I have created a simple test application that demonstrates this behavior. The user needs to replace the url in applicationDidFinishLaunching to point to a web resource that is protected by http basic authentication. Here is a reference for how to setup basic authentication on an apache server: http://httpd.apache.org/docs/current/howto/auth.html.
Comment 1 Radar WebKit Bug Importer 2014-11-18 22:27:47 PST
Comment 2 Mark Rowe (bdash) 2014-11-18 22:36:17 PST
Comment 3 Alexey Proskuryakov 2014-12-08 13:46:38 PST
The immediate cause for the problem is that calling [panel close] makes panel.sheetParent nil, so we never end the sheet.

I'll need to figure out what the correct way to use NSPanel is.
Comment 4 Alexey Proskuryakov 2014-12-08 15:47:21 PST
Created attachment 242856 [details]
proposed fix
Comment 5 Alexey Proskuryakov 2014-12-08 17:20:40 PST
Created attachment 242865 [details]
proposed fix

Make sure to call -orderOut: in modal window case. It did disappear in my testing even without that, but presumably only because of being deallocated, which is not something to rely on, as Dan pointed out.
Comment 6 WebKit Commit Bot 2014-12-08 23:26:08 PST
Comment on attachment 242865 [details]
proposed fix

Clearing flags on attachment: 242865

Committed r177011: <http://trac.webkit.org/changeset/177011>
Comment 7 WebKit Commit Bot 2014-12-08 23:26:12 PST
All reviewed patches have been landed.  Closing bug.