Bug 232730 - Deprecate _allowTLSCertificateChain:forHost:
Summary: Deprecate _allowTLSCertificateChain:forHost:
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Alex Christensen
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-11-04 15:48 PDT by Alex Christensen
Modified: 2021-11-11 14:49 PST (History)
5 users (show)

See Also:

Attachments
Patch (13.85 KB, patch)
2021-11-04 15:50 PDT, Alex Christensen 		ews-feeder: commit-queue-
Details | Formatted Diff | Diff
Patch (18.17 KB, patch)
2021-11-04 16:49 PDT, Alex Christensen 		achristensen: review?
Details | Formatted Diff | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alex Christensen 2021-11-04 15:48:27 PDT 
Deprecate _allowTLSCertificateChain:forHost:
Comment 1 Alex Christensen 2021-11-04 15:50:15 PDT 
Created attachment 443346 [details]
Patch
Comment 2 Alex Christensen 2021-11-04 16:49:18 PDT 
Created attachment 443355 [details]
Patch
Comment 3 Alex Christensen 2021-11-04 16:50:08 PDT 
It seems like this has been baked into the GTK API.  Can that be removed?  Is there a challenge-based way to allow invalid certs in the GTK API like WKNavigationDelegate.didReceiveAuthenticationChallenge?
Comment 4 EWS Watchlist 2021-11-04 16:50:27 PDT 
Thanks for the patch. If this patch contains new public API please make sure it follows the guidelines for new WebKit2 GTK+ API. See https://trac.webkit.org/wiki/WebKitGTK/AddingNewWebKit2API
Comment 5 Carlos Garcia Campos 2021-11-05 00:00:25 PDT 
This is used by apps to allow an invalid certificate when the user accepts the risks. We don't have alternative API for this, but even in that case we would need to keep the old api working for backwards compatibility.
Comment 6 Alex Christensen 2021-11-05 11:01:31 PDT 
Does libsoup have an API that asks at the time of TLS handshake whether the certificate chain should be accepted or not?
Comment 7 Alex Christensen 2021-11-05 11:04:57 PDT 
Does tlsConnectionAcceptCertificateCallback have to return a bool immediately, or is there an asynchronous version that can ask the UI process?  That's what WebKit does on Cocoa platforms.
Comment 8 Carlos Garcia Campos 2021-11-06 01:03:47 PDT 
Yes, the API is synchronous, because the GLib API for that is synchronous too. So we need to make the load fail first, tell the user about it with the button to try again on their own risk and load again after providing the tls certificate as an exception to be allowed.
Comment 9 Radar WebKit Bug Importer 2021-11-11 14:49:20 PST 
<rdar://problem/85316802>