Bug 138843 – REGRESSION (r158036): WebView cannot handle HTTP Basic Authentication challenge

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit Misc.

Created attachment 241808 [details]
Test application that demonstrates issue.

When a WebView encounters an http authentication challenge, it will show the WebAuthenticationPanel as a sheet, but after the user clicks cancel or Log in, no further web requests are sent or received with regards to the challenge.

After debugging the WebKit sources, it looks like the WebAuthenticationPanel, which handles prompting the user for credentials for HTTP authentication challenges, is currently calling [panel close] in its cancel/login button handlers before trying to call endSheet on panel.sheetParent (line 78 and 98 of https://trac.webkit.org/browser/trunk/Source/WebKit/mac/Panels/WebAuthenticationPanel.m?annotate=blame&rev=158036). While is this works on OSX 10.9, it looks like on OSX 10.10 (Yosemite) the call to [panel close] causes panel.sheetParent to become nil, which prevents the callback from being executed and the authentication challenge is never responded to.

I have created a simple test application that demonstrates this behavior. The user needs to replace the url in applicationDidFinishLaunching to point to a web resource that is protected by http basic authentication. Here is a reference for how to setup basic authentication on an apache server: http://httpd.apache.org/docs/current/howto/auth.html.

[Radar WebKit Bug Importer]

<rdar://problem/19026697>

[Mark Rowe (bdash)]

<rdar://problem/18793695>

[Alexey Proskuryakov]

The immediate cause for the problem is that calling [panel close] makes panel.sheetParent nil, so we never end the sheet.

I'll need to figure out what the correct way to use NSPanel is.

[Alexey Proskuryakov]

Created attachment 242856 [details]
proposed fix

[Alexey Proskuryakov]

Created attachment 242865 [details]
proposed fix

Make sure to call -orderOut: in modal window case. It did disappear in my testing even without that, but presumably only because of being deallocated, which is not something to rely on, as Dan pointed out.

[WebKit Commit Bot]

Comment on attachment 242865 [details]
proposed fix

Clearing flags on attachment: 242865

Committed r177011: <http://trac.webkit.org/changeset/177011>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.