Commit Graph

13 Commits

Author SHA1 Message Date
Timothy Flynn
0571e578d6 LibWeb: Reject cookies with non-ASCII domains
This is an alternate fix for the issue addressed by commit
8156531477.

Turns out we don't want to isomorphic decode the cookie header, but
decode it as UTF-8 to align with document.cookie. That will be
addressed in a subsequent commit.
2026-02-08 23:14:31 +01:00
Timothy Flynn
0482b6bb57 LibWeb+LibWebView+WebContent: Implement versioning for document cookies
This patch introduces a cookie cache in the WebContent process to reduce
blocking IPC calls when JS accesses document.cookie. The UI process now
maintains a cookie version counter per-domain in shared memory. When JS
reads document.cookie, we check whether we have a valid cached cookie by
comparing the current shared version to the last used version. If they
match, the cached cookie is returned without IPC.

This optimization is based on Chromium's shared versioning, in which it
was observed that 87% of document.cookie accesses were redundant. See:
https://blog.chromium.org/2024/06/introducing-shared-memory-versioning-to.html

Note that this cache only supports document.cookie, not HTTP Cookie
headers. HTTP cookies are attached to requests with varying URLs and
paths. The cookies that match the document URL might not match the
request URL, which we wouldn't know from WebContent. So attaching the
cached document cookie would be incorrect.

On https://twinings.co.uk, we see approximately 600 document.cookie
requests while the page loads. This patch reduces the time spent in
the document.cookie getter from ~45ms to 2-3ms.
2026-02-05 07:28:07 -05:00
Timothy Flynn
a5cabf341b LibWeb+LibWebView: Extract the cookie-matching spec steps to a helper
These were repeated in the CookieStore, and will be needed again for an
upcoming feature.
2026-01-30 07:36:13 -05:00
Timothy Flynn
c6cb963a92 LibWeb+LibWebView: Update our cookie implementation to the latest RFC
These seem to largely be editorial changes. See:
https://author-tools.ietf.org/iddiff?url1=draft-ietf-httpbis-rfc6265bis-15&url2=draft-ietf-httpbis-rfc6265bis-22&difftype=--html

I've also updated the spec links to use the "datatracker.ietf.org" URL
rather than the "www.ietf.org" URL as the former has better dark-mode
support and more handy sidebar links.
2026-01-30 07:36:13 -05:00
Timothy Flynn
dc29588389 LibWeb: Exclude IPv6 addresses from cookie domain matches
The code here is much older than our IPv6 address support. We should
be excluding these from cookie domain matches.
2026-01-30 07:36:13 -05:00
Timothy Flynn
b69e3e2f1a LibWeb: Place all cookie-related spec AOs in a single file
Rather than splitting this between Cookie and ParsedCookie, let's just
put them all in Cookie. This just makes it more obvious where to put an
upcoming helper.
2026-01-30 07:36:13 -05:00
Luke Wilde
b17783bb10 Everywhere: Change west consts caught by clang-format-21 to east consts 2025-08-29 18:18:55 +01:00
Idan Horowitz
73266c8498 LibWeb: Add missing cookie-age-limit steps to CookieStore::set() 2025-08-26 06:28:10 -04:00
ayeteadoe
3df8e00d91 LibWeb: Enable EXPLICIT_SYMBOL_EXPORT 2025-08-23 16:04:36 -06:00
Idan Horowitz
a72a0b3c2d LibWeb+LibWebView: Move RFC6265 helpers to LibWeb
This will make them usable by LibWeb's CookieStore code as well.
2025-08-08 13:09:58 -04:00
Tomasz Strejczek
6fb2be96bf Everywhere: Replace DateTime::to_string() with UnixDateTime::to_string()
Replace LibCore::DateTime::to_string() with
AK::UnixDateTime::to_string().
Remove unncessary #include <LibCore/DateTime.h>.
2025-06-19 18:42:45 -06:00
Timothy Flynn
1c075d6039 LibWeb: Remove Web::Infra ASCII case conversion methods
We have more optimized versions of these methods in AK.
2025-05-04 15:59:17 +02:00
Timothy Flynn
93712b24bf Everywhere: Hoist the Libraries folder to the top-level 2024-11-10 12:50:45 +01:00