NEW 286922
WKWebView opens opens a TLS connection before calling decidePolicyForNavigationAction (and despite it returning WKNavigationActionPolicyCancel) 
https://bugs.webkit.org/show_bug.cgi?id=286922
Summary WKWebView opens opens a TLS connection before calling decidePolicyForNavigati...
Jeff Johnson
Reported 2025-02-03 07:05:58 PST
Created attachment 474122 [details] Sample Xcode project WKWebView opens https links before the WKNavigationDelegate method webView:decidePolicyForNavigationAction:decisionHandler: is called, even with WKNavigationActionPolicyCancel. Attached is a sample Xcode project demonstrating the bug. It calls decisionHandler(WKNavigationActionPolicyCancel) for all WKNavigationTypeLinkActivated navigation actions. If you click the http: link, then it simply cancels as expected. Whereas if you click the https: link, it attempts to connect to the linked URL before decidePolicyForNavigationAction: is called. This can be verified with a firewall such as Little Snitch or a packet trace.
Attachments
Sample Xcode project (13.84 KB, application/zip)
2025-02-03 07:05 PST, Jeff Johnson 		no flags
Details
Screenshot showing the WebKit Networking process connecting to https://example.org (228.11 KB, image/png)
2025-02-03 07:06 PST, Jeff Johnson 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Jeff Johnson
Comment 1 2025-02-03 07:06:53 PST
Created attachment 474123 [details] Screenshot showing the WebKit Networking process connecting to https://example.org
Radar WebKit Bug Importer
Comment 2 2025-02-10 07:06:27 PST
<rdar://problem/144527847>
Geoffrey Garen
Comment 3 2025-02-24 12:44:42 PST
I think the word "link" may be ambiguous here. Do you mean that the WebView follows an HTML anchor link navigation, and renders the webpage? Or do you mean that the WebView opens a TLS connection (but does not follows any HTML anchor link navigation, or render any webpage)?
Jeff Johnson
Comment 4 2025-02-24 13:10:14 PST
I mean that the WebView opens a TLS connection. If it rendered the webpage, then you wouldn't need a packet trace or the like to verify the bug.
Note You need to log in before you can comment on or make changes to this bug.