Commit Graph
25 Commits
Author SHA1 Message Date
ldm0 0cd6650015 refactor(cookies): separate site history from the current method
Keep method-independent site limits and redirect diagnostic history apart
from the current HTTP method. Compute SameSite outcomes and both diagnostic
tracks when read, with one canonical method input. Method overrides no
longer reverse-repair cached SameSite results or duplicated metadata.

Preserve explicit CrossSite restrictions, scope rebinding, partition keys,
and historical downgrade diagnostics. Keep cache key material unchanged
while moving consumers to the computed context API.

Cover method round trips without history mutation and retain distinct
diagnostics when different histories end with the same CrossSite result.
2026-11-12 03:10:33 +08:00
ldm0 15a2aa1775 refactor(cookies): remove shadow context calculation and scope side effects
Run current-request tests through network_cookie_context and redirected tests
through follow_redirect, preserving Cookie header and diagnostic assertions.
Remove the test-only effective_cookie_context implementation.

Add an initiator-only update that preserves browser scope and partitioning.
Share per-track metadata operations, advance contexts without cloning URLs,
and use request-type accessors instead of constructing throwaway contexts.
2026-11-12 03:10:33 +08:00
ldm0 152fb34077 refactor(cookies): synchronize hop method when advancing redirect context
Require the actual next-hop method in advance_cookie_request_context and
update method safety and both metadata tracks before preserving site limits.
Remove the repeated synchronization from the five HTTP redirect branches;
pass the actual method through HTTPS upgrades and caller-followed redirects.

Cover GET-to-POST and POST-to-GET overrides starting from computed Lax/Unsafe
contexts, including explicit CrossSite limits. Check actual Cookie headers
in every transport, distinguishing fresh and aged default cookies from Lax.
2026-11-12 03:10:33 +08:00
ldm0 80a07dfc05 fix(cookies): synchronize method context across redirects 2026-11-12 03:10:33 +08:00
ldm0 43214c7408 fix(cookies): preserve top-level navigation allowances across redirects 2026-11-11 19:19:03 +08:00
ldm0 de15d018dd fix(cookies): enforce native SameSite contexts for script and network access
Apply per-cookie SameSite restrictions to script reads while preserving HttpOnly and privileged CDP access. Carry relationship and navigation shape into canonical insertion checks before mutation, including overwrite and expiry deletion. Keep Secure SameSite=None, top-level response allowances and precise rejection reports; remove the blanket cross-site document-cookie denial.

Extracted from development commit 1b521cee146.
Base: wpt/20261030-cookie-age-aware-samesite (a170fb14b8).

Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
     Summary [ 150.549s] 22175 tests run: 22175 passed (9 slow), 20 skipped
2026-11-02 11:12:00 +08:00
ldm0 2e4fa728e8 refactor(cookies): store creation times as Unix microseconds 2026-11-02 11:09:13 +08:00
ldm0 8b0701deeb fix(cookies): apply age-aware Lax-by-default request policy
Record and preserve cookie creation time across updates, browser imports and cache persistence. Apply modern Lax-by-default request inclusion, including the age-bounded unsafe top-level navigation allowance; keep explicit Lax and Strict semantics, raw cookie visibility and diagnostic exclusion reasons. Cover age boundaries, updates, imports, persistence and navigation contexts.
2026-11-02 11:09:13 +08:00
ldm0 7fa20ba1a5 fix(cookies): restore Secure cookies independently of source scheme 2026-11-01 04:57:03 +08:00
ldm0 800e2d1852 refactor(cookies): restore directly into the canonical jar 2026-11-01 04:03:38 +08:00
ldm0 208c670738 refactor(cookies): keep access touches in memory 2026-11-01 04:03:38 +08:00
ldm0 42680d286e refactor(storage): apply idempotent deltas without existence tracking
Keep the latest Put or Delete for each key rather than eliding transient-row
deletes. Remove existed from Cookie and localStorage deltas and Cookie mutation
observers, then remove the shared uncertain-commit correction hook. Preserve
Cookie Touch composition and atomic, idempotent retry behavior.

Replace optimization-specific assertions with actual SQL replay tests covering
a published put followed by deletion and clear followed by a newer put.
2026-11-01 04:03:38 +08:00
ldm0 5e6482996e feat(storage): open Cookie and localStorage databases on first use 2026-11-01 04:03:38 +08:00
ldm0 2defc40820 feat(cookies): persist canonical cookie deltas in SQLite 2026-11-01 04:03:38 +08:00
ldm0 7b94c7459e fix(storage): honor BiDi cookie partition descriptors 2026-10-28 19:32:35 +08:00
ldm0 dda02d5e11 fix(storage): preserve cookie identities in BiDi deletion 2026-10-28 05:54:01 +08:00
ldm0 57260aff82 refactor(cookies): make delete partition scope explicit 2026-10-28 03:14:09 +08:00
ldm0 790600db9b fix(network): match serialized cookie deletion filters
Match CDP deletion filters literally, validate required fields, and resolve cookies through the owning session. Prefer a nonempty domain over the URL while preserving shared storage and WebDriver deletion semantics.
2026-10-28 03:14:09 +08:00
ldm0 e5cf779e1a fix(network): scope cookie deletion and validate partition keys 2026-10-28 03:14:09 +08:00
ldm0 9616d01ab1 fix(cookies): handle Unicode expiration dates without panicking 2026-10-11 17:44:26 +08:00
ldm0 6d08975a69 refactor(fetch): preserve response header bytes end to end
Carry raw response header values through fetch, caches, redirects,
renderer delivery, workers, and protocol records. Convert explicitly
at WebIDL and protocol text boundaries while preserving opaque bytes.

Keep legacy CacheStorage and service worker metadata readable, and
advance the HTTP cache format for raw header values.

Validation:
- cargo fmt --all
- cargo clippy --workspace --all-targets --all-features -- -D warnings
- cargo nextest run --no-fail-fast
2026-09-23 02:02:54 +08:00
BibekPathak 91ad8c5fd4 fix(cdp): list SameSite=None; Secure cookies for loopback http URLs 2026-09-02 19:41:22 +08:00
ldm0 5547cb593d perf(site): compile public suffix rules into static trie 2026-08-31 03:59:56 +08:00
BibekPathak dda59858b5 fix(cookies): make host-only cookies port-agnostic per RFC 6265 2026-08-26 21:03:53 +08:00
ldm0 27b5135cb6 Public preview 2026-08-11 00:10:12 +08:00