Bug 319908

Summary:	Wire the Local Network Access check into NetworkResourceLoader for both final responses and redirects
Product:	WebKit	Reporter:	Ian Gower <i_gower>
Component:	Page Loading	Assignee:	Nobody <webkit-unassigned>
Status:	NEW
Severity:	Normal	CC:	beidson, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
Bug Depends on:	250607
Bug Blocks:

Ian Gower

Reported 2026-07-21 11:02:56 PDT

Wires WebCore::performLocalNetworkAccessCheck() (added in a prior patch) into NetworkResourceLoader at the two points where a load's resolved-connection address space becomes known: the final response and each redirect hop, since redirects don't flow through didReceiveResponse and could otherwise bypass the check entirely. Threads the requesting document's address space and secure-context status from WebProcess into NetworkProcess to support this. Adds a WebKitCocoa API test against the real Cocoa network stack and a layout test using the permission-stub testing hook. Part of the Local Network Access enforcement work (meta bug 250607).

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2026-07-21 11:03:03 PDT

<rdar://problem/182830246>

Ian Gower

Comment 2 2026-07-31 16:36:29 PDT

Pull request: https://github.com/WebKit/WebKit/pull/70639

Note You need to log in before you can comment on or make changes to this bug.