Skip to content

Commit 6698039

Browse files
author
Çağrı Kaan Yıldırım
authored
Add hasAuthorityComponent to CustomSchemeRegistration (#2465)
Add hasAuthorityComponent property to CustomSchemeRegistration
1 parent b33469b commit 6698039

File tree

1 file changed

+109
-42
lines changed

1 file changed

+109
-42
lines changed

‎specs/WebResourceRequested-CustomScheme.md‎

Lines changed: 109 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,8 @@ options.CustomSchemeRegistrations.Add(
7070
new CoreWebView2CustomSchemeRegistration(customScheme)
7171
{
7272
TreatAsSecure = true,
73-
AllowedOrigins = { "https://*.example.com" }
73+
AllowedOrigins = { "https://*.example.com" },
74+
HasAuthorityComponent = true
7475
});
7576
options.CustomSchemeRegistrations.Add(
7677
new CoreWebView2CustomSchemeRegistration(customSchemeNotInAllowedOrigins)
@@ -133,7 +134,7 @@ webView.CoreWebView2.Navigate("https://www.example.com");
133134
webView.CoreWebView2.ExecuteScriptAsync(
134135
@"var oReq = new XMLHttpRequest();
135136
oReq.addEventListener(""load"", reqListener);
136-
oReq.open(""GET\"", ""custom-scheme:example-data.json"");
137+
oReq.open(""GET\"", ""custom-scheme://domain/example-data.json"");
137138
oReq.send();");
138139
// The following XHR will fail because *.example.com is in the not allowed
139140
// origin list of custom-scheme2. The WebResourceRequested event will not be
@@ -159,15 +160,14 @@ if (options.As(&options3) == S_OK) {
159160
const WCHAR* allowedOrigins[1] = {L"https://*.example.com"};
160161
schemeRegistrations.push_back(
161162
Microsoft::WRL::Make<CoreWebView2CustomSchemeRegistration>(
162-
L"custom-scheme",
163-
TRUE /* treatAsSecure*/,
164-
1,
165-
allowedOrigins));
163+
L"custom-scheme"));
164+
schemeRegistrations.back()->put_HasAuthorityComponent(TRUE);
165+
schemeRegistrations.back()->put_TreatAsSecure(TRUE);
166+
schemeRegistrations.back()->SetAllowedOrigins(1, allowedOrigins);
166167
schemeRegistrations.push_back(
167168
Microsoft::WRL::Make<CoreWebView2CustomSchemeRegistration>(
168-
L"custom-scheme-not-in-allowed-origins-list",
169-
TRUE /* treatAsSecure*/,
170-
nullptr));
169+
L"custom-scheme-not-in-allowed-origins-list"));
170+
schemeRegistrations.back()->put_TreatAsSecure(TRUE);
171171
CHECK_FAILURE(options3->SetCustomSchemeRegistrations(
172172
schemeRegistrations.size(), schemeRegistrations.data()));
173173
}
@@ -245,7 +245,7 @@ CHECK_FAILURE(m_webView->Navigate(L"https://www.example.com"));
245245
CHECK_FAILURE(m_webView->ExecuteScript(
246246
L"var oReq = new XMLHttpRequest();"
247247
L"oReq.addEventListener(\"load\", reqListener);"
248-
L"oReq.open(\"GET\", \"custom-scheme:example-data.json\");"
248+
L"oReq.open(\"GET\", \"custom-scheme://domain/example-data.json\");"
249249
L"oReq.send();",
250250
Callback<ICoreWebView2ExecuteScriptCompletedHandler>(
251251
[](HRESULT error, PCWSTR result) -> HRESULT {
@@ -271,45 +271,46 @@ CHECK_FAILURE(m_webView->ExecuteScript(
271271
272272
```c#
273273
// This is the ICoreWebView2CustomSchemeRegistration interface
274+
// This represents the registration of a custom scheme with the
275+
// CoreWebView2Environment.
276+
// This allows the WebView2 app to be able to handle
277+
// WebResourceRequested event for requests with the specified scheme and
278+
// be able to navigate the WebView2 to the custom scheme. Once the environment
279+
// is created, the registrations are valid and immutable throughout the
280+
// lifetime of the associated WebView2s' browser process and any WebView2
281+
// environments sharing the browser process must be created with identical
282+
// custom scheme registrations (order does not matter), otherwise the
283+
// environment creation will fail.
284+
// If there are multiple entries for the same scheme in the registrations
285+
// list, the environment creation will also fail.
286+
// The URIs of registered custom schemes will be treated similar to http URIs
287+
// for their origins.
288+
// They will have tuple origins for URIs with authority component and opaque origins for
289+
// URIs without authority component as specified in
290+
/// [7.5 Origin - HTML Living Standard](https://html.spec.whatwg.org/multipage/origin.html)
291+
// Example:
292+
// custom-scheme-with-authority://hostname/path/to/resource has origin of
293+
// custom-scheme-with-authority://hostname
294+
// custom-scheme-without-authority:path/to/resource has origin of
295+
// custom-scheme-without-authority:path/to/resource
296+
// For WebResourceRequested event, the cases of request URIs and filter URIs
297+
// with custom schemes will be normalized according to generic URI syntax
298+
// rules. Any non-ASCII characters will be preserved.
299+
// The registered custom schemes also participate in
300+
// [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) and adheres
301+
// to [CSP](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP). The app
302+
// needs to set the appropriate access headers in its WebResourceRequested
303+
// event handler to allow CORS requests.
274304
[uuid(d60ac92c-37a6-4b26-a39e-95cfe59047bb), object, pointer_default(unique)]
275305
interface ICoreWebView2CustomSchemeRegistration : IUnknown {
276-
// Represents the registration of a custom scheme with the
277-
// CoreWebView2Environment.
278-
// This allows the WebView2 app to be able to handle
279-
// WebResourceRequested event for requests with the specified scheme and
280-
// be able to navigate the WebView2 to the custom scheme. Once the environment
281-
// is created, the registrations are valid and immutable throughout the
282-
// lifetime of the associated WebView2s' browser process and any WebView2
283-
// environments sharing the browser process must be created with identical
284-
// custom scheme registrations, otherwise the environment creation will fail.
285-
// If there are multiple entries for the same scheme in the registrations
286-
// list, the environment creation will also fail.
287-
// The URIs of registered custom schemes will be treated similar to http URIs
288-
// for their origins.
289-
// They will have tuple origins for URIs with host and opaque origins for
290-
// URIs without host as specified in
291-
/// [7.5 Origin - HTML Living Standard](https://html.spec.whatwg.org/multipage/origin.html)
292-
// Example:
293-
// custom-scheme-with-host://hostname/path/to/resource has origin of
294-
// custom-scheme-with-host://hostname
295-
// custom-scheme-without-host:path/to/resource has origin of
296-
// custom-scheme-without-host:path/to/resource
297-
// For WebResourceRequested event, the cases of request URIs and filter URIs
298-
// with custom schemes will be normalized according to generic URI syntax
299-
// rules. Any non-ASCII characters will be preserved.
300-
// The registered custom schemes also participate in
301-
// [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) and adheres
302-
// to [CSP](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP). The app
303-
// needs to set the appropriate access headers in its WebResourceRequested
304-
// event handler to allow CORS requests.
305-
306306
// The name of the custom scheme to register.
307307
[propget] HRESULT SchemeName([out, retval] LPCWSTR* schemeName);
308308
[propput] HRESULT SchemeName([in] LPCWSTR value);
309309
310310
// Whether the sites with this scheme will be treated as a
311311
// [Secure Context](https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts)
312312
// like a HTTPS site.
313+
// `false` by default.
313314
[propget] HRESULT TreatAsSecure([out, retval] BOOL* treatAsSecure);
314315
// Set if the scheme will be treated as a Secure Context.
315316
[propput] HRESULT TreatAsSecure([in] BOOL value);
@@ -319,7 +320,7 @@ interface ICoreWebView2CustomSchemeRegistration : IUnknown {
319320
// Except origins with this same custom scheme, which are always
320321
// allowed, the origin of any request (requests that have the
321322
// [Origin header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin))
322-
// to the custom scheme URL needs to be in this list. No-origin requests
323+
// to the custom scheme URI needs to be in this list. No-origin requests
323324
// are requests that do not have an Origin header, such as link
324325
// navigations, embedded images and are always allowed.
325326
// Note that cross-origin restrictions still apply.
@@ -341,6 +342,40 @@ interface ICoreWebView2CustomSchemeRegistration : IUnknown {
341342
HRESULT SetAllowedOrigins(
342343
[in] UINT32 allowedOriginsCount,
343344
[in] LPCWSTR* allowedOrigins);
345+
346+
// Set this property to `true` if the URIs with this custom
347+
// scheme will have an authority component (a host for custom schemes).
348+
// Specifically, if you have a URI of the following form you should set the
349+
// `HasAuthorityComponent` value as listed.
350+
// | URI | Recommended HasAuthorityComponent value |
351+
// | -- | -- |
352+
// | ` custom-scheme-with-authority://host/path` | `true` |
353+
// | `custom-scheme-without-authority:path` | `false` |
354+
// When this property is set to `true`, the URIs with this scheme will be
355+
// interpreted as having a
356+
// [scheme and host](https://html.spec.whatwg.org/multipage/origin.html#concept-origin-tuple)
357+
// origin similar to an http URI. Note that the port and user
358+
// information are never included in the computation of origins for
359+
// custom schemes.
360+
// If this property is set to `false`, URIs with this scheme will have an
361+
// [opaque origin](https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque)
362+
// similar to a data URI.
363+
// This property is `false` by default.
364+
//
365+
// Note: For custom schemes registered as having authority component,
366+
// navigations to URIs without authority of such custom schemes will fail.
367+
// However, if the content inside WebView2 references
368+
// a subresource with a URI that does not have
369+
// an authority component, but of a custom scheme that is registered as
370+
// having authority component, the URI will be interpreted as a relative path
371+
// as specified in [RFC3986](https://www.rfc-editor.org/rfc/rfc3986).
372+
// For example, custom-scheme-with-authority:path will be interpreted
373+
// as custom-scheme-with-authority://host/path
374+
// However, this behavior cannot be guaranteed to remain in future
375+
// releases so it is recommended not to rely on this behavior.
376+
[propget] HRESULT HasAuthorityComponent([out, retval] BOOL* hasAuthorityComponent);
377+
// Get has authority component
378+
[propput] HRESULT HasAuthorityComponent([in] BOOL hasAuthorityComponent);
344379
}
345380
346381
// This is the ICoreWebView2EnvironmentOptions3 interface
@@ -409,7 +444,7 @@ namespace Microsoft.Web.WebView2.Core
409444
// Except origins with this same custom scheme, which are always
410445
// allowed, the origin of any request (requests that have the
411446
// [Origin header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin))
412-
// to the custom scheme URL needs to be in this list. No-origin requests
447+
// to the custom scheme URI needs to be in this list. No-origin requests
413448
// are requests that do not have an Origin header, such as link
414449
// navigations, embedded images and are always allowed.
415450
// Note that cross-origin restrictions still apply.
@@ -423,6 +458,38 @@ namespace Microsoft.Web.WebView2.Core
423458
// [AddWebResourceRequestedFilter API](https://docs.microsoft.com/en-us/dotnet/api/microsoft.web.webview2.core.corewebview2.addwebresourcerequestedfilter).
424459
// For example, "http://*.example.com:80".
425460
IVector<String> AllowedOrigins { get; } = {};
461+
462+
// Set this property to `true` if the URIs with this custom
463+
// scheme will have an authority component (a host for custom schemes).
464+
// Specifically, if you have a URI of the following form you should set the
465+
// `HasAuthorityComponent` value as listed.
466+
// | URI | Recommended HasAuthorityComponent value |
467+
// | -- | -- |
468+
// | ` custom-scheme-with-authority://host/path` | `true` |
469+
// | `custom-scheme-without-authority:path` | `false` |
470+
// When this property is set to `true`, the URIs with this scheme will be
471+
// interpreted as having a
472+
// [scheme and host](https://html.spec.whatwg.org/multipage/origin.html#concept-origin-tuple)
473+
// origin similar to an http URI. Note that the port and user
474+
// information are never included in the computation of origins for
475+
// custom schemes.
476+
// If this property is set to `false`, URIs with this scheme will have an
477+
// [opaque origin](https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque)
478+
// similar to a data URI.
479+
// This property is `false` by default.
480+
//
481+
// Note: For custom schemes registered as having authority component,
482+
// navigations to URIs without authority of such custom schemes will fail.
483+
// However, if the content inside WebView2 references
484+
// a subresource with a URI that does not have
485+
// an authority component, but of a custom scheme that is registered as
486+
// having authority component, the URI will be interpreted as a relative path
487+
// as specified in [RFC3986](https://www.rfc-editor.org/rfc/rfc3986).
488+
// For example, custom-scheme-with-authority:path will be interpreted
489+
// as custom-scheme-with-authority://host/path
490+
// However, this behavior cannot be guaranteed to remain in future
491+
// releases so it is recommended not to rely on this behavior.
492+
Boolean HasAuthorityComponent {get; set; } = false;
426493
}
427494

428495
runtimeclass CoreWebView2EnvironmentOptions

0 commit comments

Comments
 (0)