tree 1f32b7818c74416351befea3628432ddc63c0914
parent 6fd14ef296a8be3b10d082813cd9f7c62299d564
author wilander@apple.com <wilander@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571265535 +0000
committer wilander@apple.com <wilander@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571265535 +0000

Resource Load Statistics (experimental): Block all third-party cookies on websites without prior user interaction
https://bugs.webkit.org/show_bug.cgi?id=203017
<rdar://problem/56262708>

Reviewed by Alex Christensen.

Source/WebCore:

NetworkStorageSession::shouldBlockCookies() now checks if the first-party website has
received user interaction and if not, blocks all third-party cookies, regardless of the
status of those third-party domains (prevalent or not).

Bundled cleanup task: Remove the two month old feature flag for NSURLSession switching.

Tests: http/tests/resourceLoadStatistics/third-party-cookie-blocking-on-sites-without-user-interaction-database.html
       http/tests/resourceLoadStatistics/third-party-cookie-blocking-on-sites-without-user-interaction.html

* page/RuntimeEnabledFeatures.h:
(WebCore::RuntimeEnabledFeatures::setIsITPSessionSwitchingEnabled): Deleted.
(WebCore::RuntimeEnabledFeatures::isITPSessionSwitchingEnabled const): Deleted.
* page/Settings.yaml:
* platform/network/NetworkStorageSession.cpp:
(WebCore::NetworkStorageSession::hasHadUserInteractionAsFirstParty const):
(WebCore::NetworkStorageSession::shouldBlockCookies const):
(WebCore::NetworkStorageSession::setDomainsWithUserInteractionAsFirstParty):
* platform/network/NetworkStorageSession.h:
(WebCore::NetworkStorageSession::setIsThirdPartyCookieBlockingOnSitesWithoutUserInteractionEnabled):

Source/WebKit:

This enhancement is off by default and controlled by an internal feature flag.

The functional change is in WebCore::NetworkStorageSession::shouldBlockCookies() which is
called from:
- NetworkDataTaskCocoa::NetworkDataTaskCocoa()
- NetworkDataTaskCocoa::willPerformHTTPRedirection

shouldBlockCookies() now checks if the first-party website has received user interaction
and if not, blocks all third-party cookies, regardless of the status of those third-party
domains (prevalent or not).

The changes to ResourceLoadStatisticsDatabaseStore and ResourceLoadStatisticsMemoryStore
are about communicating which domains have received user interaction (prevalent or not)
to the network storage session so that it can enforce the new restriction.

The C API change and piping through the WebsiteDataStore is test infrastructure.

Bundled cleanup task: Remove the two month old feature flag for NSURLSession switching.

* NetworkProcess/Classifier/ResourceLoadStatisticsDatabaseStore.cpp:
(WebKit::CompletionHandler<void):
* NetworkProcess/Classifier/ResourceLoadStatisticsDatabaseStore.h:
* NetworkProcess/Classifier/ResourceLoadStatisticsMemoryStore.cpp:
(WebKit::ResourceLoadStatisticsMemoryStore::clear):
(WebKit::ResourceLoadStatisticsMemoryStore::updateCookieBlocking):
* NetworkProcess/Classifier/WebResourceLoadStatisticsStore.cpp:
(WebKit::WebResourceLoadStatisticsStore::callUpdatePrevalentDomainsToBlockCookiesForHandler):
* NetworkProcess/Classifier/WebResourceLoadStatisticsStore.h:
(WebKit::RegistrableDomainsToBlockCookiesFor::isolatedCopy const):
* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::initializeNetworkProcess):
(WebKit::NetworkProcess::setShouldBlockThirdPartyCookiesForTesting):
* NetworkProcess/NetworkProcess.messages.in:
* NetworkProcess/NetworkSession.cpp:
(WebKit::NetworkSession::NetworkSession):
* NetworkProcess/NetworkSession.h:
(WebKit::NetworkSession::setResourceLoadStatisticsLogTestingEvent):
(WebKit::NetworkSession::shouldIsolateSessionsForPrevalentTopFrames const): Deleted.
* NetworkProcess/NetworkSessionCreationParameters.cpp:
(WebKit::NetworkSessionCreationParameters::encode const):
(WebKit::NetworkSessionCreationParameters::decode):
* NetworkProcess/NetworkSessionCreationParameters.h:
* NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:
(WebKit::NetworkDataTaskCocoa::NetworkDataTaskCocoa):
* NetworkProcess/cocoa/NetworkSessionCocoa.mm:
(WebKit::NetworkSessionCocoa::NetworkSessionCocoa):
* Shared/WebPreferences.yaml:
* UIProcess/API/C/WKWebsiteDataStoreRef.cpp:
(WKWebsiteDataStoreSetResourceLoadStatisticsShouldBlockThirdPartyCookiesForTesting):
(WKWebsiteDataStoreStatisticsResetToConsistentState):
* UIProcess/API/C/WKWebsiteDataStoreRef.h:
* UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::setShouldBlockThirdPartyCookiesForTesting):
* UIProcess/Network/NetworkProcessProxy.h:
* UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm:
(WebKit::WebsiteDataStore::parameters):
* UIProcess/WebsiteData/WebsiteDataStore.cpp:
(WebKit::WebsiteDataStore::setResourceLoadStatisticsShouldBlockThirdPartyCookiesForTesting):
* UIProcess/WebsiteData/WebsiteDataStore.h:

Tools:

These changes are test infrastructure to be able to toggle the function
through testRunner.setStatisticsShouldBlockThirdPartyCookies().

* WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
* WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
(WTR::InjectedBundle::didReceiveMessageToPage):
* WebKitTestRunner/InjectedBundle/TestRunner.cpp:
(WTR::TestRunner::setStatisticsShouldBlockThirdPartyCookies):
(WTR::TestRunner::statisticsCallDidSetShouldBlockThirdPartyCookiesCallback):
* WebKitTestRunner/InjectedBundle/TestRunner.h:
* WebKitTestRunner/TestController.cpp:
(WTR::TestController::setStatisticsShouldBlockThirdPartyCookies):
* WebKitTestRunner/TestController.h:
* WebKitTestRunner/TestInvocation.cpp:
(WTR::TestInvocation::didReceiveSynchronousMessageFromInjectedBundle):
(WTR::TestInvocation::didSetShouldBlockThirdPartyCookies):
* WebKitTestRunner/TestInvocation.h:

LayoutTests:

* http/tests/resourceLoadStatistics/third-party-cookie-blocking-on-sites-without-user-interaction-database-expected.txt: Added.
* http/tests/resourceLoadStatistics/third-party-cookie-blocking-on-sites-without-user-interaction-database.html: Added.
* http/tests/resourceLoadStatistics/third-party-cookie-blocking-on-sites-without-user-interaction-expected.txt: Added.
* http/tests/resourceLoadStatistics/third-party-cookie-blocking-on-sites-without-user-interaction.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@251213 268f45cc-cd09-0410-ab3c-d52691b4dbfc