Bug 210487 – [SOUP] ResourceLoadStatistics: add support for isolated sessions

• Status: NEW
• Component: WebKitGTK

[Carlos Garcia Campos]

Looking at the cocoa code I'm not entirely sure what the expected behavior is, and I think the layout tests just check that an isolated session is used, but not the behavior when it's used.

[Michael Catanzaro]

Discussion on this here: https://bugs.webkit.org/show_bug.cgi?id=210184#c11

[Michael Catanzaro]

In particular, from bug #210184:

> GLib doesn't have any way to prevent session resumption, so it would be impossible to do in libsoup alone without changes in GLib. I could add GLib API for you if desired. Would be easy to do, and would allow removing a hack we use to disable session resumption when running tests. (Currently calling g_test_init() will disable session resumption, because there's no API tests can use to do that, so this behavior has to be tested manually.)

I'd be good to hear more from John about the intent behind isolated network sessions, though. Is there more that's not supposed to be shared besides the TLS session? (Disk cache? Could websites fingerprint users based on what resources they have in disk cache?)

[Carlos Garcia Campos]

Yes, please, I still don't know what the expected behavior is to see how to implement it in libsoup if needed.

[Carlos Garcia Campos]

I have another question for John or Youenn. I've noticed that resource load stats are removed automatically for origins when the cookies or hsts cache is removed for them, but it doesn't seem to be possible to remove the stats specifically for a set of registrable domains, since it's not possible to fetch the list of registrable domains with stats. Is that on purpose? I started to add support for fetch/remove but then I realized that maybe it was not implemented on purpose.

[Carlos Garcia Campos]

(In reply to Carlos Garcia Campos from comment #4)
> I have another question for John or Youenn. I've noticed that resource load
> stats are removed automatically for origins when the cookies or hsts cache
> is removed for them, but it doesn't seem to be possible to remove the stats
> specifically for a set of registrable domains, since it's not possible to
> fetch the list of registrable domains with stats. Is that on purpose? I
> started to add support for fetch/remove but then I realized that maybe it
> was not implemented on purpose.

I misread the code, deleting stats for a specific host is supported, it's weird that the display name is used, though. But fetch is not implemented.