feat: support HTTP Basic auth on macOS WKWebView - #1356
Merged
Conversation
macOS WKWebView never shows the native 401 dialog, so sites behind HTTP Basic auth render "Authentication required" and are unusable. Add a --basic-auth user:pass CLI option that installs a navigation-delegate proxy answering Basic challenges, and send the initial navigation with the Authorization header so the cold-start 401 race cannot trigger. - bin: --basic-auth option, config plumbing, schema, docs, dist rebuild - src-tauri: new app/auth.rs delegate proxy with KVO guard (macOS only) - window.rs: about:blank start + delegate install for the main window
The base64-encoded credential comes back from msg_send as a raw *mut NSString; calling to_string() on the pointer does not compile. Dereference it to &NSString (Display impl) first.
…the delegate user/pass are moved into PakeBasicAuthDelegate::new, so building the base64 header after that point borrows moved values. Compute it first (borrowing only), then hand ownership to the delegate.
The Authorization header build can fail (nil NSData/NSString), which previously aborted setup and left the window stuck on about:blank. Fall back to a bare navigation and let the challenge delegate answer the 401 instead. Also drop the stale "lazy delegate install" wording from comments (wry sets its navigation delegate at webview creation) and remove the mistaken reference to issue tw93#1348 (that issue is about mTLS client certificates, not HTTP Basic auth).
Owner
|
@xiaojueshi Thanks for digging into WKWebView's missing Basic Auth prompt. I reworked the authentication path on your branch so credentials are requested at runtime in a compact native macOS dialog, scoped to the target host, kept only for the session, and compatible with the existing certificate handling; it is now merged into main and will ship in the next Pake release. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a
--basic-auth <user:pass>CLI option that makes HTTP Basic auth work on macOS. WKWebView never shows the native 401 dialog, so sites behind Basic auth render an "Authentication required" error page and are unusable in Pake apps. The option installs a navigation-delegate proxy that answers Basic challenges, and sends the initial navigation with theAuthorizationheader so the cold-start 401 race never triggers.Why
macOS WKWebView only handles the 401 challenge path when the app implements
webView:didReceiveAuthenticationChallenge:completionHandler:; wry'sWryNavigationDelegatedoes not implement it, so WebKit falls back to default handling (reject the challenge, show the 401 body). Windows WebView2 and Linux WebKitGTK show their own dialogs, so this is a macOS-only gap.Changes
bin/: new--basic-auth <user:pass>option; config plumbingbasicAuth→pake.basic_authsrc-tauri/: newapp/auth.rs— WKWebView navigation-delegate proxy (objc2) answering HTTP Basic challenges with anNSURLCredential, plus a KVO guard that re-asserts the proxy if anything later replaces the delegatesrc-tauri/src/app/window.rs: for the main window, start onabout:blank, install the delegate, then navigate with the Authorization header embedded in the first requestschema/pake.schema.json,docs/cli-usage*.md,dist/cli.js: CLI surface kept in sync (enforced by the config-file sync test)Tests
npx vitest run: 343 tests pass, including the schema/CLI sync suiteparse_basic_authunit tests: empty input, missing separator, empty user, empty password, colons in passwordnode dist/cli.js <url> --basic-auth user:pass --iterative-buildcompiles and bundles cleanly on aarch64-apple-darwin; the app opens directly to the authenticated site with no "Authentication required" page on first launchRisks
--basic-authwith--ignore-certificate-errorsdoes not chain perfectly (documented inauth.rs)docs/cli-usage.md)pake-N) do not