NEW295336
Cross-origin XMLHttpRequest triggers additional extension permissions request 
https://bugs.webkit.org/show_bug.cgi?id=295336
Summary Cross-origin XMLHttpRequest triggers additional extension permissions request
Jeff Johnson
Reported 2025-07-02 08:54:35 PDT
Created attachment 475748 [details] Sample Safari extension Steps to reproduce: 1. Download and unzip the attached sample Safari extension in Resources.zip 2. Enable the extension in Safari 3. In Terminal, cd Downloads/Resources 4. /usr/bin/python3 -m http.server 5. Open http://localhost:8000 in Safari See the attached screenshots showing the permission requests. This happens in the main frame and also in iframes, and even if the extension has no website permissions already. If you first grant the extension permission to access localhost:8000, there are still permission requests for example.org and example.com. I've seen this bug occur on iOS as well as macOS, though I haven't able to reproduce it until now. The bug also occurs in Safari web apps.
Attachments
Sample Safari extension (203.55 KB, application/zip)
2025-07-02 08:54 PDT, Jeff Johnson 		no flags
Details
Screenshot (611.34 KB, image/png)
2025-07-02 08:54 PDT, Jeff Johnson 		no flags
Details
Screenshot (143.99 KB, image/png)
2025-07-02 08:55 PDT, Jeff Johnson 		no flags
Details
Screenshot (588.71 KB, image/png)
2025-07-02 08:55 PDT, Jeff Johnson 		no flags
Details
iOS screenshot (348.52 KB, image/png)
2025-07-02 08:55 PDT, Jeff Johnson 		no flags
Details
iOS screenshot (98.66 KB, image/png)
2025-07-02 08:56 PDT, Jeff Johnson 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2025-07-02 08:54:44 PDT
<rdar://problem/154866064>
Jeff Johnson
Comment 2 2025-07-02 08:54:56 PDT
Created attachment 475749 [details] Screenshot
Jeff Johnson
Comment 3 2025-07-02 08:55:11 PDT
Created attachment 475750 [details] Screenshot
Jeff Johnson
Comment 4 2025-07-02 08:55:24 PDT
Created attachment 475751 [details] Screenshot
Jeff Johnson
Comment 5 2025-07-02 08:55:46 PDT
Created attachment 475752 [details] iOS screenshot
Jeff Johnson
Comment 6 2025-07-02 08:56:00 PDT
Created attachment 475753 [details] iOS screenshot
Note You need to log in before you can comment on or make changes to this bug.