Bug 151658 – Provide public WKWebView API for _committedURL

• Status: NEW
• Component: WebKit2

[Stuart Morgan]

Knowing the committed URL of the page is critical for a variety of security purposes (knowing what to show for a render-initiated navigation, knowing the origin for integrating with native features such as password autofill, etc.)

The "URL" property of WKWebView is unsuitable for those purposes, since it includes pending URLs as soon as a provisional navigation starts. Trying to track the committed URL via navigation delegates and KVO callbacks is quite complicated, and potentially error-prone, meaning the lack of this API increases the chances of security issues in software based on WKWebView.

There is a private property called _committedURL, which is presumably exactly this information. It should be a public API so that clients can more easily write secure software.