@itwin/ecschema-rpcinterface-tests 5.13.0-dev.15 → 5.13.0-dev.17

package/lib/dist/bundled-tests.js

@@ -91445,6 +91445,8 @@ const COPYRIGHT_NOTICE = `Copyright © 2017-${new Date().getFullYear()} <a href=
 
 
 
+/** CSS class name applied to the notice element of a logo card created by [[IModelApp.makeLogoCard]]. */
+const logoCardNoticeClassName = "logo-cards";
 /**
  * Global singleton that connects the user interface with the iTwin.js services. There can be only one IModelApp active in a session. All
  * members of IModelApp are static, and it serves as a singleton object for gaining access to session information.
@@ -91957,10 +91959,21 @@ class IModelApp {
         }
         if (undefined !== opts.notice) {
             if (typeof opts.notice === "string")
-                IModelApp.makeHTMLElement("p", { parent: noticeCell, innerHTML: opts.notice, className: "logo-cards" });
+                IModelApp.makeHTMLElement("p", { parent: noticeCell, innerHTML: opts.notice, className: logoCardNoticeClassName });
             else
                 noticeCell.appendChild(opts.notice);
         }
+        else if (undefined !== opts.noticeLines) {
+            // A <p> cannot legally contain flow content, so use a <div> when a line is an element.
+            const containerTag = opts.noticeLines.some((line) => typeof line !== "string") ? "div" : "p";
+            const notice = IModelApp.makeHTMLElement(containerTag, { parent: noticeCell, className: logoCardNoticeClassName });
+            opts.noticeLines.forEach((line, index) => {
+                if (index > 0)
+                    notice.appendChild(IModelApp.makeHTMLElement("br"));
+                // Strings are appended as text nodes so they are never parsed as HTML.
+                notice.append(line);
+            });
+        }
         return card;
     }
     /** Make the logo card for the library itself. This card gets placed at the top of the stack.
@@ -93527,7 +93540,9 @@ let iModelJsCss = `
 
 .logo-cards {
   position:relative;
-  width:100%
+  width:100%;
+  margin-block-start:1em;
+  margin-block-end:1em
 }
 
 .imodeljs-modal-overlay {
@@ -93571,7 +93586,7 @@ let iModelJsCss = `
     max-width: calc(100% - (2 * var(--width-border))) !important;
     width: unset !important;
   }
-  .imodeljs-about .logo-card-message p {
+  .imodeljs-about .logo-card-message p, .imodeljs-about .logo-card-message .logo-cards {
     margin-block-end: 1em;
   }
   .imodeljs-about .logo-cards {
@@ -96217,9 +96232,12 @@ class Google3dTilesProvider {
             // Order by most occurances to least
             // See https://developers.google.com/maps/documentation/tile/create-renderer#display-attributions
             const sortedCopyrights = [...copyrightMap.entries()].sort((a, b) => b[1] - a[1]);
-            let copyrightMsg = "Data provided by:<br><ul>";
-            copyrightMsg += sortedCopyrights.map(([key]) => `<li>${key}</li>`).join("");
-            copyrightMsg += "</ul>";
+            const list = document.createElement("ul");
+            for (const [key] of sortedCopyrights) {
+                const item = document.createElement("li");
+                item.textContent = key;
+                list.appendChild(item);
+            }
             const iconSrc = document.createElement("img");
             iconSrc.src = `${_IModelApp__WEBPACK_IMPORTED_MODULE_8__.IModelApp.publicPath}images/GoogleMaps_Logo_Gray.svg`;
             iconSrc.style.padding = "10px 10px 5px 10px";
@@ -96227,7 +96245,7 @@ class Google3dTilesProvider {
                 iconSrc,
                 iconWidth: 98,
                 heading: "Google Photorealistic 3D Tiles",
-                notice: copyrightMsg
+                noticeLines: ["Data provided by:", list],
             }));
         }
     }
@@ -116617,7 +116635,7 @@ class GoogleMapsDecorator {
         const copyrightText = sortedCopyrights.map(([key]) => ` • ${key}`).join("");
         // Create and add element, offset to leave space for i.js and Google logos
         const elem = document.createElement("div");
-        elem.innerHTML = copyrightText;
+        elem.textContent = copyrightText;
         elem.style.color = "white";
         elem.style.fontSize = "11px";
         elem.style.textWrap = "wrap";
@@ -153924,7 +153942,11 @@ class OrbitGtTreeReference extends _tile_internal__WEBPACK_IMPORTED_MODULE_9__.R
         if (this._name)
             strings.push(`${_IModelApp__WEBPACK_IMPORTED_MODULE_6__.IModelApp.localization.getLocalizedString("iModelJs:TooltipInfo.Name")} ${this._name}`);
         const div = document.createElement("div");
-        div.innerHTML = strings.join("<br>");
+        strings.forEach((str, index) => {
+            if (index > 0)
+                div.appendChild(document.createElement("br"));
+            div.appendChild(document.createTextNode(str));
+        });
         return div;
     }
 }
@@ -155688,7 +155710,11 @@ class RealityTreeReference extends RealityModelTileTree.Reference {
                 if (-1 === key.indexOf("#")) // Avoid internal cesium
                     strings.push(`${key}: ${JSON.stringify(batch[key])}`);
         const div = document.createElement("div");
-        div.innerHTML = strings.join("<br>");
+        strings.forEach((str, index) => {
+            if (index > 0)
+                div.appendChild(document.createElement("br"));
+            div.appendChild(document.createTextNode(str));
+        });
         return div;
     }
     /** @deprecated in 5.0 - might be removed in next major version. Use [addAttributions] instead. */
@@ -156876,7 +156902,21 @@ class ArcGisUtilities {
     */
     static async validateSource(args) {
         const { source, ignoreCache, capabilitiesFilter } = args;
-        const metadata = await this.getServiceJson({ url: source.url, formatId: source.formatId, userName: source.userName, password: source.password, queryParams: source.collectQueryParams(), ignoreCache });
+        let metadata;
+        try {
+            metadata = await this.getServiceJson({ url: source.url, formatId: source.formatId, userName: source.userName, password: source.password, queryParams: source.collectQueryParams(), ignoreCache });
+        }
+        catch (err) {
+            if (err instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerUntrustedOriginError) {
+                let blockedOrigin;
+                try {
+                    blockedOrigin = new URL(err.url).origin;
+                }
+                catch { /* non-hierarchical URL */ }
+                return { status: _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerSourceStatus.UntrustedOrigin, blockedOrigin };
+            }
+            throw err;
+        }
         const json = metadata?.content;
         if (json === undefined) {
             return { status: _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerSourceStatus.InvalidUrl };
@@ -156939,6 +156979,9 @@ class ArcGisUtilities {
      * @param password Password to use for legacy token based security
      * @param ignoreCache Flag to skip cache lookup (i.e. force a new server request)
      * @param requireToken Flag to indicate if a token is required
+     * @throws [[MapLayerUntrustedOriginError]] if an NTLM/Negotiate challenge could not be answered because
+     * the URL's origin is not trusted (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]);
+     * all other errors are caught and reported by returning `undefined`.
      */
     static async getServiceJson(args) {
         const { url, formatId, userName, password, queryParams, ignoreCache, requireToken } = args;
@@ -156974,8 +157017,17 @@ class ArcGisUtilities {
             }
             let response = await fetch(tmpUrl, { method: "GET" });
             if (response.status === 401 && !requireToken && (0,_request_utils__WEBPACK_IMPORTED_MODULE_3__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])) {
-                // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication)
-                response = await fetch(tmpUrl, { method: "GET", credentials: "include" });
+                // fetch follows redirects transparently, so trust decisions target the final (post-redirect) URL.
+                const challengedUrl = response.url || tmpUrl.toString();
+                if (!_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.mapLayerFormatRegistry.isSsoAllowed(challengedUrl))
+                    throw new _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerUntrustedOriginError(challengedUrl);
+                _IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.mapLayerFormatRegistry.logUntrustedOriginUse(challengedUrl);
+                // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication).
+                response = await fetch(challengedUrl, {
+                    method: "GET",
+                    credentials: "include",
+                    redirect: _IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined,
+                });
             }
             // Append security token when corresponding error code is returned by ArcGIS service
             let errorCode = await ArcGisUtilities.checkForResponseErrorCode(response);
@@ -156997,8 +157049,10 @@ class ArcGisUtilities {
             ArcGisUtilities._serviceCache.set(url, (errorCode === undefined ? info : undefined));
             return info; // Always return json, even though it contains an error code.
         }
-        catch {
+        catch (err) {
             ArcGisUtilities._serviceCache.set(url, undefined);
+            if (err instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_1__.MapLayerUntrustedOriginError)
+                throw err; // propagate so callers can report the blocked origin
             return undefined;
         }
     }
@@ -157160,7 +157214,9 @@ class ArcGISImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODULE_0__.
         try {
             metadata = await _tile_internal__WEBPACK_IMPORTED_MODULE_0__.ArcGisUtilities.getServiceJson({ url: this._settings.url, formatId: this._settings.formatId, userName: this._settings.userName, password: this._settings.password, queryParams: this._settings.collectQueryParams() });
         }
-        catch {
+        catch (err) {
+            if (err instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerUntrustedOriginError)
+                this.reportBlockedOrigin(err.url);
         }
         if (metadata && metadata.accessTokenRequired) {
             const accessClient = _IModelApp__WEBPACK_IMPORTED_MODULE_1__.IModelApp.mapLayerFormatRegistry.getAccessClient(this._settings.formatId);
@@ -157208,12 +157264,32 @@ class ArcGISImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODULE_0__.
             await this._firstRequestPromise;
         let response;
         try {
-            response = await fetch(urlObj, { ...options, credentials: this._includeUserCredentials ? "include" : undefined });
+            const requestUrl = urlObj.toString();
+            const includeCredentials = this.includeUserCredentials(requestUrl);
+            response = await fetch(urlObj, {
+                ...options,
+                credentials: includeCredentials ? "include" : undefined,
+                redirect: includeCredentials ? this.credentialedRedirect : options?.redirect,
+            });
+            if (includeCredentials)
+                this.checkCredentialedRedirect(requestUrl, response);
             if (response.status === 401 && !this._lastAccessToken && (0,_request_utils__WEBPACK_IMPORTED_MODULE_3__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])) {
-                // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication)
-                response = await fetch(urlObj, { ...options, credentials: "include" });
-                if (response.status === 200) {
-                    this._includeUserCredentials = true; // avoid going through 401 challenges over and over
+                // fetch follows redirects transparently, so trust decisions target the final (post-redirect) URL.
+                const challengedUrl = response.url || requestUrl;
+                if (this.isSsoAllowed(challengedUrl)) {
+                    // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication).
+                    this.logUntrustedOriginUse(challengedUrl);
+                    response = await fetch(challengedUrl, {
+                        ...options,
+                        credentials: "include",
+                        redirect: _IModelApp__WEBPACK_IMPORTED_MODULE_1__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined,
+                    });
+                    if (response.status === 200) {
+                        this.recordSsoSucceeded(challengedUrl); // avoid going through 401 challenges over and over for this origin
+                    }
+                }
+                else {
+                    this.reportBlockedOrigin(challengedUrl);
                 }
             }
             if ((this._lastAccessToken && response.status === 400)
@@ -157426,8 +157502,12 @@ class ArcGISMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MOD
     }
     async initialize() {
         const metadata = await this.getServiceJson();
-        if (metadata?.content === undefined)
+        if (metadata?.content === undefined) {
+            // By returning (i.e., not throwing), we ensure the tile tree gets created and the current provider is preserved to report status.
+            if (this.status === _tile_internal__WEBPACK_IMPORTED_MODULE_2__.MapLayerImageryProviderStatus.UntrustedOrigin)
+                return;
             throw new _itwin_core_common__WEBPACK_IMPORTED_MODULE_0__.ServerError(_itwin_core_bentley__WEBPACK_IMPORTED_MODULE_5__.IModelStatus.ValidationFailed, "");
+        }
         const json = metadata.content;
         if (json?.error?.code === _tile_internal__WEBPACK_IMPORTED_MODULE_2__.ArcGisErrorCode.TokenRequired
             || json?.error?.code === _tile_internal__WEBPACK_IMPORTED_MODULE_2__.ArcGisErrorCode.InvalidToken
@@ -157512,7 +157592,7 @@ class ArcGISMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MOD
     addLogoCards(cards) {
         if (!cards.dataset.arcGisLogoCard) {
             cards.dataset.arcGisLogoCard = "true";
-            cards.appendChild(_IModelApp__WEBPACK_IMPORTED_MODULE_1__.IModelApp.makeLogoCard({ heading: "ArcGIS", notice: this._copyrightText }));
+            cards.appendChild(_IModelApp__WEBPACK_IMPORTED_MODULE_1__.IModelApp.makeLogoCard({ heading: "ArcGIS", noticeLines: [this._copyrightText] }));
         }
     }
     async addAttributions(cards, _vp) {
@@ -157553,7 +157633,7 @@ class ArcGISMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MOD
         if (json && Array.isArray(json.results)) {
             for (const result of json.results) {
                 if (result.attributes !== undefined && result.attributes[result.displayFieldName] !== undefined) {
-                    const thisString = `${result.displayFieldName}: ${result.attributes[result.displayFieldName]}`;
+                    const thisString = `${(0,_tile_internal__WEBPACK_IMPORTED_MODULE_2__.escapeHtml)(String(result.displayFieldName))}: ${(0,_tile_internal__WEBPACK_IMPORTED_MODULE_2__.escapeHtml)(String(result.attributes[result.displayFieldName]))}`;
                     if (!stringSet.has(thisString)) {
                         strings.push(thisString);
                         stringSet.add(thisString);
@@ -157869,13 +157949,7 @@ class BingMapsImageryLayerProvider extends _tile_internal__WEBPACK_IMPORTED_MODU
         const copyrights = [];
         for (const match of matchingAttributions)
             copyrights.push(match.copyrightMessage);
-        let copyrightMsg = "";
-        for (let i = 0; i < copyrights.length; ++i) {
-            if (i > 0)
-                copyrightMsg += "<br>";
-            copyrightMsg += copyrights[i];
-        }
-        cards.appendChild(_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.makeLogoCard({ iconSrc: `${_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.publicPath}images/bing.svg`, heading: "Microsoft Bing", notice: copyrightMsg }));
+        cards.appendChild(_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.makeLogoCard({ iconSrc: `${_IModelApp__WEBPACK_IMPORTED_MODULE_2__.IModelApp.publicPath}images/bing.svg`, heading: "Microsoft Bing", noticeLines: copyrights }));
     }
     async addAttributions(cards, vp) {
         // eslint-disable-next-line @typescript-eslint/no-deprecated
@@ -158484,7 +158558,10 @@ class WmsMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODULE
             // Don't throw error if unauthorized status:
             // We want the tile tree to be created, so that end-user can get feedback on which layer is missing credentials.
             // When credentials will be provided, a new provider will be created, and initialization should be fine.
-            if (error?.status === 401) {
+            if (error instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_3__.MapLayerUntrustedOriginError) {
+                this.reportBlockedOrigin(error.url);
+            }
+            else if (error?.status === 401) {
                 this.setStatus(_tile_internal__WEBPACK_IMPORTED_MODULE_3__.MapLayerImageryProviderStatus.RequireAuth);
             }
             else {
@@ -158646,7 +158723,8 @@ class WmtsMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODUL
     }
     async initialize() {
         try {
-            this._capabilities = await _tile_internal__WEBPACK_IMPORTED_MODULE_2__.WmtsCapabilities.create(this._baseUrl);
+            const credentials = (this._settings.userName && this._settings.password ? { user: this._settings.userName, password: this._settings.password } : undefined);
+            this._capabilities = await _tile_internal__WEBPACK_IMPORTED_MODULE_2__.WmtsCapabilities.create(this._baseUrl, credentials);
             this.initPreferredTileMatrixSet();
             this.initPreferredStyle();
             this.initDisplayedLayer();
@@ -158659,7 +158737,10 @@ class WmtsMapLayerImageryProvider extends _tile_internal__WEBPACK_IMPORTED_MODUL
             // Don't throw error if unauthorized status:
             // We want the tile tree to be created, so that end-user can get feedback on which layer is missing credentials.
             // When credentials will be provided, a new provider will be created, and initialization should be fine.
-            if (error?.status === 401) {
+            if (error instanceof _tile_internal__WEBPACK_IMPORTED_MODULE_2__.MapLayerUntrustedOriginError) {
+                this.reportBlockedOrigin(error.url);
+            }
+            else if (error?.status === 401) {
                 this.setStatus(_tile_internal__WEBPACK_IMPORTED_MODULE_2__.MapLayerImageryProviderStatus.RequireAuth);
             }
             else {
@@ -159470,14 +159551,18 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   WmsUtilities: () => (/* binding */ WmsUtilities)
 /* harmony export */ });
-/* harmony import */ var _request_Request__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! ../../../request/Request */ "../../core/frontend/lib/esm/request/Request.js");
-/* harmony import */ var _request_utils__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! ../../../request/utils */ "../../core/frontend/lib/esm/request/utils.js");
+/* harmony import */ var _IModelApp__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! ../../../IModelApp */ "../../core/frontend/lib/esm/IModelApp.js");
+/* harmony import */ var _request_Request__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! ../../../request/Request */ "../../core/frontend/lib/esm/request/Request.js");
+/* harmony import */ var _request_utils__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(/*! ../../../request/utils */ "../../core/frontend/lib/esm/request/utils.js");
+/* harmony import */ var _tile_internal__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(/*! ../../../tile/internal */ "../../core/frontend/lib/esm/tile/internal.js");
 /*---------------------------------------------------------------------------------------------
 * Copyright (c) Bentley Systems, Incorporated. All rights reserved.
 * See LICENSE.md in the project root for license terms and full copyright notice.
 *--------------------------------------------------------------------------------------------*/
 
 
+
+
 /** @packageDocumentation
  * @module Tiles
  */
@@ -159494,16 +159579,35 @@ class WmsUtilities {
     static async fetchXml(url, credentials) {
         let headers;
         if (credentials && credentials.user && credentials.password) {
-            headers = new Headers();
-            (0,_request_utils__WEBPACK_IMPORTED_MODULE_1__.setBasicAuthorization)(headers, credentials);
+            // Basic credentials are considered settings-derived credentials for this source. When the registry is
+            // enforcing trusted origins, the source URL itself is the only implicitly trusted origin for basic auth;
+            // opaque/custom-protocol URLs have no network origin and must therefore be treated as untrusted.
+            const allowBasicAuth = !_IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins
+                || _IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.isCredentialsSharingAllowed(url, url);
+            if (allowBasicAuth) {
+                headers = new Headers();
+                (0,_request_utils__WEBPACK_IMPORTED_MODULE_2__.setBasicAuthorization)(headers, credentials);
+            }
         }
         let response = await fetch(url, { method: "GET", headers });
-        if (!credentials && response.status === 401 && (0,_request_utils__WEBPACK_IMPORTED_MODULE_1__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])) {
-            // We got a http 401 challenge, lets try SSO (i.e. Windows Authentication)
-            response = await fetch(url, { method: "GET", credentials: "include" });
+        if (!headers && credentials && credentials.user && credentials.password && (response.status === 401 || response.status === 403)) {
+            throw new _tile_internal__WEBPACK_IMPORTED_MODULE_3__.MapLayerUntrustedOriginError(url);
+        }
+        if (!credentials && response.status === 401 && (0,_request_utils__WEBPACK_IMPORTED_MODULE_2__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])) {
+            // fetch follows redirects transparently, so trust decisions target the final (post-redirect) URL.
+            const challengedUrl = response.url || url;
+            if (!_IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.isSsoAllowed(challengedUrl))
+                throw new _tile_internal__WEBPACK_IMPORTED_MODULE_3__.MapLayerUntrustedOriginError(challengedUrl);
+            _IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.logUntrustedOriginUse(challengedUrl);
+            // We got a http 401 challenge, lets try SSO (i.e. Windows Authentication).
+            response = await fetch(challengedUrl, {
+                method: "GET",
+                credentials: "include",
+                redirect: _IModelApp__WEBPACK_IMPORTED_MODULE_0__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined,
+            });
         }
         if (response.status !== 200)
-            throw new _request_Request__WEBPACK_IMPORTED_MODULE_0__.HttpResponseError(response.status, await response.text());
+            throw new _request_Request__WEBPACK_IMPORTED_MODULE_1__.HttpResponseError(response.status, await response.text());
         return response.text();
     }
 }
@@ -171917,6 +172021,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   MapLayerSourceStatus: () => (/* reexport safe */ _map_MapLayerSources__WEBPACK_IMPORTED_MODULE_86__.MapLayerSourceStatus),
 /* harmony export */   MapLayerSources: () => (/* reexport safe */ _map_MapLayerSources__WEBPACK_IMPORTED_MODULE_86__.MapLayerSources),
 /* harmony export */   MapLayerTileTreeReference: () => (/* reexport safe */ _map_MapLayerTileTreeReference__WEBPACK_IMPORTED_MODULE_64__.MapLayerTileTreeReference),
+/* harmony export */   MapLayerUntrustedOriginError: () => (/* reexport safe */ _map_MapLayerFormatRegistry__WEBPACK_IMPORTED_MODULE_42__.MapLayerUntrustedOriginError),
 /* harmony export */   MapTile: () => (/* reexport safe */ _map_MapTile__WEBPACK_IMPORTED_MODULE_70__.MapTile),
 /* harmony export */   MapTileLoader: () => (/* reexport safe */ _internal_tile_map_MapTileLoader__WEBPACK_IMPORTED_MODULE_72__.MapTileLoader),
 /* harmony export */   MapTileProjection: () => (/* reexport safe */ _map_MapTile__WEBPACK_IMPORTED_MODULE_70__.MapTileProjection),
@@ -172012,6 +172117,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   decodeMeshoptBuffer: () => (/* reexport safe */ _internal_tile_MeshoptCompression__WEBPACK_IMPORTED_MODULE_93__.decodeMeshoptBuffer),
 /* harmony export */   deflateCoordinates: () => (/* reexport safe */ _internal_tile_map_ImageryProviders_CoordinatesUtils__WEBPACK_IMPORTED_MODULE_47__.deflateCoordinates),
 /* harmony export */   disposeTileTreesForGeometricModels: () => (/* reexport safe */ _internal_tile_PrimaryTileTree__WEBPACK_IMPORTED_MODULE_82__.disposeTileTreesForGeometricModels),
+/* harmony export */   escapeHtml: () => (/* reexport safe */ _map_MapLayerImageryProvider__WEBPACK_IMPORTED_MODULE_49__.escapeHtml),
 /* harmony export */   getCesiumAccessClient: () => (/* reexport safe */ _map_CesiumTerrainProvider__WEBPACK_IMPORTED_MODULE_68__.getCesiumAccessClient),
 /* harmony export */   getCesiumAccessTokenAndEndpointUrl: () => (/* reexport safe */ _map_CesiumTerrainProvider__WEBPACK_IMPORTED_MODULE_68__.getCesiumAccessTokenAndEndpointUrl),
 /* harmony export */   getCesiumAssetUrl: () => (/* reexport safe */ _map_CesiumTerrainProvider__WEBPACK_IMPORTED_MODULE_68__.getCesiumAssetUrl),
@@ -172031,7 +172137,8 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   readImdlContent: () => (/* reexport safe */ _ImdlReader__WEBPACK_IMPORTED_MODULE_35__.readImdlContent),
 /* harmony export */   readPntsColors: () => (/* reexport safe */ _internal_tile_PntsReader__WEBPACK_IMPORTED_MODULE_76__.readPntsColors),
 /* harmony export */   readPointCloudTileContent: () => (/* reexport safe */ _internal_tile_PntsReader__WEBPACK_IMPORTED_MODULE_76__.readPointCloudTileContent),
-/* harmony export */   tileTreeReferenceFromRenderGraphic: () => (/* reexport safe */ _RenderGraphicTileTree__WEBPACK_IMPORTED_MODULE_78__.tileTreeReferenceFromRenderGraphic)
+/* harmony export */   tileTreeReferenceFromRenderGraphic: () => (/* reexport safe */ _RenderGraphicTileTree__WEBPACK_IMPORTED_MODULE_78__.tileTreeReferenceFromRenderGraphic),
+/* harmony export */   tryGetOrigin: () => (/* reexport safe */ _map_MapLayerImageryProvider__WEBPACK_IMPORTED_MODULE_49__.tryGetOrigin)
 /* harmony export */ });
 /* harmony import */ var _internal_tile_ViewFlagOverrides__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! ../internal/tile/ViewFlagOverrides */ "../../core/frontend/lib/esm/internal/tile/ViewFlagOverrides.js");
 /* harmony import */ var _map_MapCartoRectangle__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! ./map/MapCartoRectangle */ "../../core/frontend/lib/esm/tile/map/MapCartoRectangle.js");
@@ -173730,7 +173837,8 @@ __webpack_require__.r(__webpack_exports__);
 __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   MapLayerFormat: () => (/* binding */ MapLayerFormat),
-/* harmony export */   MapLayerFormatRegistry: () => (/* binding */ MapLayerFormatRegistry)
+/* harmony export */   MapLayerFormatRegistry: () => (/* binding */ MapLayerFormatRegistry),
+/* harmony export */   MapLayerUntrustedOriginError: () => (/* binding */ MapLayerUntrustedOriginError)
 /* harmony export */ });
 /* harmony import */ var _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! @itwin/core-bentley */ "../../core/bentley/lib/esm/core-bentley.js");
 /* harmony import */ var _IModelApp__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! ../../IModelApp */ "../../core/frontend/lib/esm/IModelApp.js");
@@ -173745,7 +173853,7 @@ __webpack_require__.r(__webpack_exports__);
 
 
 
-const loggerCategory = "ArcGISFeatureProvider";
+const loggerCategory = "MapLayerFormatRegistry";
 /**
  * Class representing a map-layer format.
  * Each format has it's unique 'formatId' string, used to uniquely identify a format in the [[MapLayerFormatRegistry]].
@@ -173794,16 +173902,127 @@ class MapLayerFormat {
         return undefined;
     }
 }
+/** Error thrown when an NTLM or Negotiate http 401 challenge could not be answered because the request
+ * URL's origin is not listed in [[MapLayerFormatRegistry.trustedCredentialsOrigins]]
+ * (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+ * Thrown by the static map-layer utilities (e.g. capabilities / service-metadata fetches) that have no
+ * provider instance on which to report the blocked origin; callers convert it to
+ * [[MapLayerImageryProviderStatus.UntrustedOrigin]] (provider initialization) or
+ * [[MapLayerSourceStatus.UntrustedOrigin]] (source validation).
+ * @internal
+ */
+class MapLayerUntrustedOriginError extends Error {
+    /** The URL of the request whose authentication challenge was left unanswered. */
+    url;
+    constructor(url) {
+        super(`Authentication blocked: origin of '${url}' is not listed in MapLayerFormatRegistry.trustedCredentialsOrigins`);
+        this.url = url;
+    }
+}
 /**
  * A registry of MapLayerFormats identified by their unique format IDs. The registry can be accessed via [[IModelApp.mapLayerFormatRegistry]].
  * @public
  */
 class MapLayerFormatRegistry {
     _configOptions;
+    _trustedCredentialsOrigins = [];
+    /** Opt-in enforcement of origin restrictions on map-layer credentials.
+     * When enabled, map layer providers:
+     * - attach the basic-auth credentials stored in the layer settings only to requests targeting the origin
+     *   of the layer's settings URL or an origin listed in [[trustedCredentialsOrigins]];
+     * - retry a request with browser credentials included (i.e. SSO / Windows Authentication) after an NTLM
+     *   or Negotiate http 401 challenge only for origins explicitly listed in [[trustedCredentialsOrigins]]
+     *   (the settings-URL origin is NOT implicitly trusted for SSO, since map-layer URLs may originate from
+     *   untrusted user input while SSO shares the user's ambient identity).
+     * Default is false, preserving the legacy behavior of sending credentials to any request URL.
+     * @beta
+     */
+    restrictCredentialsToTrustedOrigins = false;
     constructor(opts) {
         this._configOptions = opts ?? {};
         _internal__WEBPACK_IMPORTED_MODULE_2__.internalMapLayerImageryFormats.forEach((format) => this.register(format));
     }
+    /** Origins (e.g. "https://tiles.example.com") to which map layer providers may send credentials —
+     * both the basic-auth credentials stored in the layer settings and browser credentials for
+     * SSO (i.e. Windows Authentication) retries after an NTLM or Negotiate http 401 challenge.
+     * Only enforced when [[restrictCredentialsToTrustedOrigins]] is enabled.
+     * For basic-auth, the origin of each map layer's settings URL is always implicitly trusted; for SSO,
+     * origins must be explicitly listed here.
+     * Entries are normalized to their origin (scheme + host + port); only `http:` and `https:` URLs are accepted,
+     * and any other entry is ignored and logged. Opaque schemes such as `file:`, `data:`, `about:` and custom
+     * Electron protocols are rejected because they all share the same serialized origin, so trusting one would
+     * trust every other.
+     * @beta
+     */
+    get trustedCredentialsOrigins() {
+        return this._trustedCredentialsOrigins;
+    }
+    set trustedCredentialsOrigins(origins) {
+        const normalized = [];
+        for (const entry of origins) {
+            const origin = (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(entry);
+            if (origin !== undefined)
+                normalized.push(origin);
+            else
+                _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Logger.logWarning(loggerCategory, `trustedCredentialsOrigins: ignoring '${entry}'; entries must be http or https URLs.`);
+        }
+        this._trustedCredentialsOrigins = normalized;
+    }
+    /** Returns true if a request to the given URL may be retried with browser credentials included
+     * (i.e. SSO / Windows Authentication) after an NTLM or Negotiate http 401 challenge.
+     * Always true unless [[restrictCredentialsToTrustedOrigins]] is enabled (opt-in).
+     * When enabled, the URL's origin must be explicitly listed in [[trustedCredentialsOrigins]];
+     * unlike basic-auth, the settings-URL origin is NOT implicitly trusted because SSO shares the user's
+     * ambient identity, and map-layer URLs may originate from untrusted user input.
+     * @internal
+     */
+    isSsoAllowed(url) {
+        if (!this.restrictCredentialsToTrustedOrigins)
+            return true;
+        const origin = (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(url);
+        // Entries are normalized to their origin by the [[trustedCredentialsOrigins]] setter.
+        return origin !== undefined && this._trustedCredentialsOrigins.includes(origin);
+    }
+    /** Returns true if the basic-auth credentials belonging to a map-layer source or settings URL may be
+     * attached to a request to the given URL. Always true unless [[restrictCredentialsToTrustedOrigins]]
+     * is enabled (opt-in). When enabled, the origin of `settingsUrl` is implicitly trusted (the credentials
+     * belong to that server); any other origin must be listed in [[trustedCredentialsOrigins]].
+     * @internal
+     */
+    isCredentialsSharingAllowed(url, settingsUrl) {
+        if (!this.restrictCredentialsToTrustedOrigins)
+            return true;
+        const origin = (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(url);
+        if (origin === undefined)
+            return false;
+        if (origin === (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(settingsUrl))
+            return true;
+        // Entries are normalized to their origin by the [[trustedCredentialsOrigins]] setter.
+        return this._trustedCredentialsOrigins.includes(origin);
+    }
+    /** Origins for which a "credentials sent to untrusted origin" warning was already logged;
+     * used to log the discovery warning only once per origin.
+     */
+    _untrustedUseLogged = new Set();
+    /** Logs a warning (once per origin) when credentials are sent to an origin that would be blocked
+     * if [[restrictCredentialsToTrustedOrigins]] were enabled.
+     * Helps applications discover the origins they need to whitelist before opting in to the restriction.
+     * If `settingsUrl` is supplied, requests sharing its origin are not logged, since that origin is
+     * implicitly trusted for basic-auth.
+     * @internal
+     */
+    logUntrustedOriginUse(url, settingsUrl) {
+        if (this.restrictCredentialsToTrustedOrigins)
+            return; // restriction active; nothing to preview
+        const origin = (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(url) ?? url;
+        if (settingsUrl !== undefined && origin === (0,_internal__WEBPACK_IMPORTED_MODULE_2__.tryGetOrigin)(settingsUrl))
+            return; // implicitly trusted for basic-auth
+        if (this._untrustedUseLogged.has(origin) || this._trustedCredentialsOrigins.includes(origin))
+            return;
+        this._untrustedUseLogged.add(origin);
+        _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.Logger.logWarning(loggerCategory, `Credentials sent to origin '${origin}' which is not in MapLayerFormatRegistry.trustedCredentialsOrigins; `
+            + "this request would be blocked if restrictCredentialsToTrustedOrigins were enabled.");
+    }
     _formats = new Map();
     isRegistered(formatId) { return this._formats.get(formatId) !== undefined; }
     register(formatClass) {
@@ -173969,6 +174188,14 @@ class WmsMapLayerFormat extends ImageryMapLayerFormat {
             return { status: _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.Valid, subLayers };
         }
         catch (err) {
+            if (err instanceof _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerUntrustedOriginError) {
+                let blockedOrigin;
+                try {
+                    blockedOrigin = new URL(err.url).origin;
+                }
+                catch { /* non-hierarchical URL */ }
+                return { status: _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.UntrustedOrigin, blockedOrigin };
+            }
             let status = _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.InvalidUrl;
             if (err?.status === 401) {
                 status = ((userName && password) ? _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.InvalidCredentials : _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.RequireAuth);
@@ -174034,6 +174261,14 @@ class WmtsMapLayerFormat extends ImageryMapLayerFormat {
             return { status: _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.Valid, subLayers };
         }
         catch (err) {
+            if (err instanceof _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerUntrustedOriginError) {
+                let blockedOrigin;
+                try {
+                    blockedOrigin = new URL(err.url).origin;
+                }
+                catch { /* non-hierarchical URL */ }
+                return { status: _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.UntrustedOrigin, blockedOrigin };
+            }
             let status = _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.InvalidUrl;
             if (err?.status === 401) {
                 status = ((userName && password) ? _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.InvalidCredentials : _internal__WEBPACK_IMPORTED_MODULE_0__.MapLayerSourceStatus.RequireAuth);
@@ -174098,7 +174333,9 @@ const internalMapLayerImageryFormats = [WmsMapLayerFormat, WmtsMapLayerFormat, A
 __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   MapLayerImageryProvider: () => (/* binding */ MapLayerImageryProvider),
-/* harmony export */   MapLayerImageryProviderStatus: () => (/* binding */ MapLayerImageryProviderStatus)
+/* harmony export */   MapLayerImageryProviderStatus: () => (/* binding */ MapLayerImageryProviderStatus),
+/* harmony export */   escapeHtml: () => (/* binding */ escapeHtml),
+/* harmony export */   tryGetOrigin: () => (/* binding */ tryGetOrigin)
 /* harmony export */ });
 /* harmony import */ var _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! @itwin/core-bentley */ "../../core/bentley/lib/esm/core-bentley.js");
 /* harmony import */ var _itwin_core_common__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(/*! @itwin/core-common */ "../../core/common/lib/esm/core-common.js");
@@ -174125,6 +174362,34 @@ __webpack_require__.r(__webpack_exports__);
 const tileImageSize = 256, untiledImageSize = 256;
 const earthRadius = 6378137;
 const doDebugToolTips = false;
+/** Escapes HTML metacharacters so the text renders literally when assigned to `innerHTML`.
+ * Use for any server- or user-supplied string that ends up in the map tooltip, which is rendered
+ * as HTML by [[MapLayerTileTreeReference.getToolTip]].
+ * @internal
+ */
+function escapeHtml(text) {
+    return text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+}
+/** Returns the origin (scheme + host + port) of the given URL, or undefined if it cannot be parsed or does
+ * not denote a distinct network origin.
+ *
+ * Only `http:` and `https:` URLs yield an origin. Every other scheme is rejected because opaque URLs
+ * — `file:`, `data:`, `about:`, `blob:null`, and the custom protocols Electron hosts commonly register —
+ * all serialize to the literal string `"null"`. Comparing those would make unrelated URLs look same-origin,
+ * so a single trusted entry could unlock all of them. Callers use this for credential-trust decisions, and
+ * returning `undefined` keeps those decisions fail-closed.
+ * @internal
+ */
+function tryGetOrigin(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return undefined;
+    }
+    return (parsed.protocol === "http:" || parsed.protocol === "https:") ? parsed.origin : undefined;
+}
 /** The status of the map layer imagery provider that lets you know if authentication is needed to request tiles.
  * @public
  */
@@ -174132,6 +174397,12 @@ var MapLayerImageryProviderStatus;
 (function (MapLayerImageryProviderStatus) {
     MapLayerImageryProviderStatus[MapLayerImageryProviderStatus["Valid"] = 0] = "Valid";
     MapLayerImageryProviderStatus[MapLayerImageryProviderStatus["RequireAuth"] = 1] = "RequireAuth";
+    /** A request received an authentication challenge, but credentials were withheld because the request origin
+     * is not trusted (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * The blocked origins are available via [[MapLayerImageryProvider.blockedOrigins]].
+     * @beta
+     */
+    MapLayerImageryProviderStatus[MapLayerImageryProviderStatus["UntrustedOrigin"] = 2] = "UntrustedOrigin";
 })(MapLayerImageryProviderStatus || (MapLayerImageryProviderStatus = {}));
 /** Abstract class for map layer imagery providers.
  * Map layer imagery providers request and provide tile images and other data. Each map layer from a separate source needs its own imagery provider object.
@@ -174149,7 +174420,41 @@ class MapLayerImageryProvider {
     /** @internal */
     _status = MapLayerImageryProviderStatus.Valid;
     /** @internal */
-    _includeUserCredentials = false;
+    _blockedOrigins = new Set();
+    /** Origins of requests for which credentials were withheld because they are not trusted
+     * (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * Populated when [[status]] transitions to [[MapLayerImageryProviderStatus.UntrustedOrigin]];
+     * [[onStatusChanged]] is raised again each time a new origin is added. Cleared by [[resetStatus]].
+     * @beta
+     */
+    get blockedOrigins() { return [...this._blockedOrigins]; }
+    /** Origins for which a previous SSO handshake (i.e. Windows Authentication) succeeded.
+     * Browser credentials are only included for subsequent requests targeting these origins,
+     * so that a successful handshake with one host does not leak credentials to other hosts
+     * this provider may contact.
+     * @internal
+     */
+    _ssoSucceededOrigins = new Set();
+    /** Returns true if browser credentials should be included for the given URL because a previous
+     * SSO handshake succeeded for its origin AND the origin is still allowed by the current policy
+     * (see [[MapLayerFormatRegistry.isSsoAllowed]]). Re-checking the policy ensures a handshake recorded
+     * while enforcement was disabled — or before an origin was removed from
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]] — does not keep latching credentials on.
+     * @internal
+     */
+    includeUserCredentials(url) {
+        const origin = tryGetOrigin(url);
+        return origin !== undefined && this._ssoSucceededOrigins.has(origin) && this.isSsoAllowed(url);
+    }
+    /** Records that an SSO handshake succeeded for the given URL's origin, so subsequent requests
+     * to that origin include browser credentials without going through another 401 challenge.
+     * @internal
+     */
+    recordSsoSucceeded(url) {
+        const origin = tryGetOrigin(url);
+        if (origin !== undefined)
+            this._ssoSucceededOrigins.add(origin);
+    }
     /** @internal */
     onFirstRequestCompleted = new _itwin_core_bentley__WEBPACK_IMPORTED_MODULE_0__.BeEvent();
     /** @internal */
@@ -174165,7 +174470,17 @@ class MapLayerImageryProvider {
      * @public
      */
     get supportsMapFeatureInfo() { return false; }
-    resetStatus() { this.setStatus(MapLayerImageryProviderStatus.Valid); }
+    /** Reset the provider's status to [[MapLayerImageryProviderStatus.Valid]] and clear the list of
+     * [[blockedOrigins]] accumulated while in the [[MapLayerImageryProviderStatus.UntrustedOrigin]] state.
+     * Raises [[onStatusChanged]] if the status actually changes.
+     * Typically called after the user has provided credentials or the application has updated
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]], so that subsequent requests are re-attempted.
+     * @beta
+     */
+    resetStatus() {
+        this._blockedOrigins.clear();
+        this.setStatus(MapLayerImageryProviderStatus.Valid);
+    }
     /** @internal */
     get tileSize() { return this._usesCachedTiles ? tileImageSize : untiledImageSize; }
     /** @internal */
@@ -174339,6 +174654,32 @@ class MapLayerImageryProvider {
             (0,_request_utils__WEBPACK_IMPORTED_MODULE_6__.setBasicAuthorization)(headers, this._settings.userName, this._settings.password);
         }
     }
+    /** Returns true if the given URL has the same origin as this layer's settings URL.
+     * Used to avoid leaking credentials to third-party hosts.
+     * @internal
+     */
+    matchesSettingsUrlOrigin(url) {
+        const origin = tryGetOrigin(url);
+        return origin !== undefined && origin === tryGetOrigin(this._settings.url);
+    }
+    /** Returns true if the basic-auth credentials from the layer settings may be attached to a request to the given URL.
+     * Always true unless [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is enabled (opt-in).
+     * When enabled, the origin of this layer's settings URL is implicitly trusted (the credentials belong to that
+     * server); other origins must be listed in [[MapLayerFormatRegistry.trustedCredentialsOrigins]].
+     * See [[MapLayerFormatRegistry.isCredentialsSharingAllowed]].
+     * @internal
+     */
+    isCredentialsSharingAllowed(url) {
+        return _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.isCredentialsSharingAllowed(url, this._settings.url);
+    }
+    /** Returns true if a request to the given URL may be retried with browser credentials included
+     * (i.e. SSO / Windows Authentication) after an NTLM or Negotiate http 401 challenge.
+     * See [[MapLayerFormatRegistry.isSsoAllowed]].
+     * @internal
+     */
+    isSsoAllowed(url) {
+        return _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.isSsoAllowed(url);
+    }
     /** @internal */
     async makeTileRequest(url, timeoutMs, authorization) {
         // We want to complete the first request before letting other requests go;
@@ -174358,41 +174699,133 @@ class MapLayerImageryProvider {
             throw new Error("fetch call failed");
         return response;
     }
+    /** Records the given URL's origin and transitions the status to [[MapLayerImageryProviderStatus.UntrustedOrigin]].
+     * Called when a request received an authentication challenge that could not be answered because the origin
+     * is not trusted (see [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]]).
+     * Raises [[onStatusChanged]] on the status transition, and again whenever a new origin is added.
+     * @internal
+     */
+    reportBlockedOrigin(url) {
+        const origin = tryGetOrigin(url) ?? url;
+        const isNewOrigin = !this._blockedOrigins.has(origin);
+        this._blockedOrigins.add(origin);
+        if (this._status !== MapLayerImageryProviderStatus.UntrustedOrigin)
+            this.setStatus(MapLayerImageryProviderStatus.UntrustedOrigin);
+        else if (isNewOrigin)
+            this.onStatusChanged.raiseEvent(this); // status unchanged, but a new origin was blocked
+    }
+    /** Logs a warning (once per origin, app-wide) when credentials are sent to an origin that would be blocked
+     * if [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] were enabled.
+     * Helps applications discover the origins they need to whitelist before opting in to the restriction.
+     * See [[MapLayerFormatRegistry.logUntrustedOriginUse]].
+     * @internal
+     */
+    logUntrustedOriginUse(url) {
+        _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.logUntrustedOriginUse(url);
+    }
+    /** The redirect policy to apply to a request that carries browser credentials (see [[includeUserCredentials]]).
+     *
+     * When [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is enabled, redirects are refused
+     * outright (`"error"`). `fetch` cannot be asked to follow only same-origin redirects, and by the time a
+     * followed redirect can be inspected the credentials have already been delivered to the destination — so
+     * refusing is the only way to honour the guarantee that credentials reach none but the origins listed in
+     * [[MapLayerFormatRegistry.trustedCredentialsOrigins]]. Legitimate same-origin redirects fail as a result;
+     * that is the cost of the opt-in restriction.
+     *
+     * When the restriction is disabled (the default), redirects are followed as before and
+     * [[checkCredentialedRedirect]] reports the destination after the fact.
+     * @internal
+     */
+    get credentialedRedirect() {
+        return _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined;
+    }
+    /** Detects that a request carrying browser credentials (see [[includeUserCredentials]]) was transparently
+     * redirected to a different origin, and reports or logs that origin.
+     *
+     * This is a **best-effort, after-the-fact** signal used only while
+     * [[MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]] is disabled, where credentialed requests
+     * still follow redirects (see [[credentialedRedirect]]). It cannot prevent the exposure — the credentials
+     * have already been sent — and it does not fire at all when the destination denies CORS, because `fetch`
+     * then rejects instead of returning a `Response`. The destination origin is never latched as SSO-succeeded,
+     * so credentials do not keep flowing to it.
+     * @internal
+     */
+    checkCredentialedRedirect(requestedUrl, response) {
+        const finalOrigin = tryGetOrigin(response.url);
+        if (!response.url || finalOrigin === undefined || finalOrigin === tryGetOrigin(requestedUrl))
+            return;
+        if (!this.isSsoAllowed(response.url))
+            this.reportBlockedOrigin(response.url);
+        else
+            this.logUntrustedOriginUse(response.url); // no-op when the restriction is enabled
+    }
     /** @internal */
     async makeRequest(url, timeoutMs, authorization) {
         let response;
         let headers;
         let hasCreds = false;
+        // Whether this request had basic-auth credentials of its own to offer. Requests carrying a caller-supplied
+        // `authorization` are excluded: those bypass the origin policy entirely.
+        const hasSettingsCreds = !authorization && !!this._settings.userName && !!this._settings.password;
         if (authorization) {
             headers = new Headers();
             headers.set("Authorization", authorization);
         }
-        else if (this._settings.userName && this._settings.password) {
-            hasCreds = true;
-            headers = new Headers();
-            this.setRequestAuthorization(headers);
+        else if (hasSettingsCreds) {
+            if (this.isCredentialsSharingAllowed(url)) {
+                hasCreds = true;
+                headers = new Headers();
+                this.setRequestAuthorization(headers);
+                if (!this.matchesSettingsUrlOrigin(url))
+                    this.logUntrustedOriginUse(url);
+            }
         }
+        const includeCredentials = this.includeUserCredentials(url);
         const opts = {
             method: "GET",
             headers,
-            credentials: this._includeUserCredentials ? "include" : undefined,
+            credentials: includeCredentials ? "include" : undefined,
+            redirect: includeCredentials ? this.credentialedRedirect : undefined,
         };
         if (timeoutMs !== undefined)
             (0,_request_utils__WEBPACK_IMPORTED_MODULE_6__.setRequestTimeout)(opts, timeoutMs);
         response = await fetch(url, opts);
+        if (includeCredentials)
+            this.checkCredentialedRedirect(url, response);
+        // fetch follows redirects transparently, so all trust decisions below target the final
+        // (post-redirect) URL reported by the response, not the URL we asked for.
+        const challengedUrl = response.url || url;
         if (response.status === 401
             && (0,_request_utils__WEBPACK_IMPORTED_MODULE_6__.headersIncludeAuthMethod)(response.headers, ["ntlm", "negotiate"])
-            && !this._includeUserCredentials
+            && !includeCredentials
             && !hasCreds) {
-            // Removed the previous headers and make sure "include" credentials is set
-            opts.headers = undefined;
-            opts.credentials = "include";
-            // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication)
-            response = await fetch(url, opts);
-            if (response.status === 200) {
-                this._includeUserCredentials = true; // avoid going through 401 challenges over and over
+            if (this.isSsoAllowed(challengedUrl)) {
+                // Removed the previous headers and make sure "include" credentials is set
+                opts.headers = undefined;
+                opts.credentials = "include";
+                // A Negotiate/NTLM handshake is normally a same-URL 401 round-trip, but in legacy mode we preserve
+                // the previous behavior and allow the browser to follow redirects after the authenticated retry.
+                opts.redirect = _IModelApp__WEBPACK_IMPORTED_MODULE_3__.IModelApp.mapLayerFormatRegistry.restrictCredentialsToTrustedOrigins ? "error" : undefined;
+                this.logUntrustedOriginUse(challengedUrl);
+                // We got a http 401 challenge, lets try again with SSO enabled (i.e. Windows Authentication)
+                response = await fetch(challengedUrl, opts);
+                if (response.status === 200) {
+                    this.recordSsoSucceeded(challengedUrl); // avoid going through 401 challenges over and over for this origin
+                }
+            }
+            else {
+                this.reportBlockedOrigin(challengedUrl);
             }
         }
+        else if ((response.status === 401 || response.status === 403) && hasSettingsCreds && !this.isCredentialsSharingAllowed(challengedUrl)) {
+            // Some servers answer an unauthenticated request with 403 (Forbidden) rather than a 401 challenge;
+            // since this request could not present its credentials to the challenging origin, either status most
+            // likely results from that. The permission is recomputed for the challenged URL rather than reusing the
+            // decision made for the requested one: `fetch` strips the Authorization header when it follows a
+            // cross-origin redirect, so a trusted request can still arrive unauthenticated at an untrusted origin,
+            // and conversely a request that started out untrusted may end up at an origin that is trusted.
+            this.reportBlockedOrigin(challengedUrl);
+        }
         return response;
     }
     /** Returns a map layer tile at the specified settings. */
@@ -174423,16 +174856,28 @@ class MapLayerImageryProvider {
     }
     /** @internal */
     async toolTipFromUrl(strings, url) {
-        const headers = new Headers();
-        this.setRequestAuthorization(headers);
+        let headers;
+        if (this.isCredentialsSharingAllowed(url)) {
+            headers = new Headers();
+            this.setRequestAuthorization(headers);
+        }
         try {
+            const includeCredentials = this.includeUserCredentials(url);
             const response = await fetch(url, {
                 method: "GET",
                 headers,
-                credentials: this._includeUserCredentials ? "include" : undefined,
+                credentials: includeCredentials ? "include" : undefined,
+                redirect: includeCredentials ? this.credentialedRedirect : undefined,
             });
-            const text = await response.text();
-            if (undefined !== text) {
+            if (includeCredentials)
+                this.checkCredentialedRedirect(url, response);
+            let text = await response.text();
+            if (text) {
+                // Tooltip content (e.g. WMS GetFeatureInfo responses) is rendered as HTML downstream and may
+                // deliberately contain markup; text from origins not trusted for credentials is escaped.
+                // fetch follows redirects transparently, so the text may come from a different origin than requested.
+                if (!this.isCredentialsSharingAllowed(response.url || url))
+                    text = escapeHtml(text);
                 strings.push(text);
             }
         }
@@ -174612,6 +175057,12 @@ var MapLayerSourceStatus;
     /** Format is not compatible with the URL provided.
      */
     MapLayerSourceStatus[MapLayerSourceStatus["IncompatibleFormat"] = 7] = "IncompatibleFormat";
+    /** Authentication could not be attempted because the source's origin is not trusted
+     * (see [MapLayerFormatRegistry.restrictCredentialsToTrustedOrigins]($frontend)). Add the origin to
+     * [MapLayerFormatRegistry.trustedCredentialsOrigins]($frontend) rather than prompting for credentials.
+     * @beta
+     */
+    MapLayerSourceStatus[MapLayerSourceStatus["UntrustedOrigin"] = 8] = "UntrustedOrigin";
 })(MapLayerSourceStatus || (MapLayerSourceStatus = {}));
 /** A source for map layers. These may be catalogued for convenient use by users or applications.
  * @public
@@ -174899,10 +175350,8 @@ class MapLayerTileTreeReference extends _internal__WEBPACK_IMPORTED_MODULE_3__.T
         const tree = this.treeOwner.tileTree;
         if (undefined === tree || hit.iModel !== tree.iModel || tree.modelId !== hit.sourceId)
             return undefined;
-        const strings = [];
-        strings.push(`Map Layer: ${this._layerSettings.name}`);
         const div = document.createElement("div");
-        div.innerHTML = strings.join("<br>");
+        div.textContent = `Map Layer: ${this._layerSettings.name}`;
         return div;
     }
     decorate(_context) {
@@ -176611,7 +177060,9 @@ class MapTileTreeReference extends _internal__WEBPACK_IMPORTED_MODULE_7__.TileTr
         let carto;
         const strings = [];
         const getTooltipFunc = async (imageryTreeRef, quadId, cartoGraphic, imageryTree) => {
-            strings.push(`${_IModelApp__WEBPACK_IMPORTED_MODULE_4__.IModelApp.localization.getLocalizedString("iModelJs:MapLayers.ImageryLayer")}: ${imageryTreeRef.layerSettings.name}`);
+            // innerHTML is used below because imageryLoader.getToolTip may deliberately supply markup.
+            const layerName = (0,_internal__WEBPACK_IMPORTED_MODULE_7__.escapeHtml)(imageryTreeRef.layerSettings.name);
+            strings.push(`${_IModelApp__WEBPACK_IMPORTED_MODULE_4__.IModelApp.localization.getLocalizedString("iModelJs:MapLayers.ImageryLayer")}: ${layerName}`);
             carto = cartoGraphic;
             await imageryTree.imageryLoader.getToolTip(strings, quadId, cartoGraphic, imageryTree);
         };
@@ -334493,7 +334944,7 @@ var loadLanguages = instance.loadLanguages;
 (module) {
 
 "use strict";
-module.exports = /*#__PURE__*/JSON.parse('{"name":"@itwin/core-frontend","version":"5.13.0-dev.15","description":"iTwin.js frontend components","main":"lib/cjs/core-frontend.js","module":"lib/esm/core-frontend.js","typings":"lib/cjs/core-frontend","license":"MIT","scripts":{"build":"npm run -s copy:public && npm run -s build:cjs && npm run -s build:esm && npm run -s build:workers && npm run -s copy:draco","build:cjs":"npm run -s copy:js:cjs && tsc 1>&2 --outDir lib/cjs","build:esm":"npm run -s copy:js:esm && tsc 1>&2 --module ES2022 --outDir lib/esm","clean":"rimraf -g lib .rush/temp/package-deps*.json","copy:public":"cpx \\"./src/public/**/*\\" ./lib/public","copy:js:cjs":"cpx \\"./src/**/*.js\\" ./lib/cjs","copy:js:esm":"cpx \\"./src/**/*.js\\" ./lib/esm","copy:draco":"cpx \\"./node_modules/@loaders.gl/draco/dist/libs/*\\" ./lib/public/scripts","docs":"betools docs --json=../../generated-docs/core/core-frontend/file.json --tsIndexFile=./core-frontend.ts --onlyJson --excludes=webgl/**/*,**/map/*.d.ts,**/tile/*.d.ts,**/*-css.ts && npm run -s extract","extract":"betools extract --fileExt=ts --extractFrom=./src/test/example-code --recursive --out=../../generated-docs/extract","extract-api":"betools extract-api --entry=core-frontend && npm run extract-extension-api","extract-extension-api":"eslint --no-inline-config -c extraction.eslint.config.js  \\"./src/**/*.ts\\" 1>&2","lint":"eslint \\"./src/**/*.ts\\" 1>&2","lint-fix":"eslint --fix -f visualstudio \\"./src/**/*.ts\\" 1>&2","lint-deprecation":"eslint --fix -f visualstudio --no-inline-config -c ../../common/config/eslint/eslint.config.deprecation-policy.js \\"./src/**/*.ts\\"","pseudolocalize":"betools pseudolocalize --englishDir ./src/public/locales/en --out ./public/locales/en-PSEUDO","test":"npm run build:test-worker && vitest --run","cover":"npm run build:test-worker && vitest --run","build:test-worker":"vite build --config ./src/test/worker/vite.config.mts 1>&2","build:workers":"rimraf lib/workers/webpack && vite build --config ./src/workers/ImdlParser/vite.config.mts 1>&2"},"repository":{"type":"git","url":"https://github.com/iTwin/itwinjs-core.git","directory":"core/frontend"},"keywords":["Bentley","BIM","iModel","digital-twin","iTwin"],"author":{"name":"Bentley Systems, Inc.","url":"http://www.bentley.com"},"peerDependencies":{"@itwin/appui-abstract":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*"},"//devDependencies":["NOTE: All peerDependencies should also be listed as devDependencies since peerDependencies are not considered by npm install","NOTE: All tools used by scripts in this package must be listed as devDependencies"],"devDependencies":{"@bentley/aec-units-schema":"^1.0.3","@bentley/formats-schema":"^1.0.0","@bentley/units-schema":"^1.0.11","@itwin/appui-abstract":"workspace:*","@itwin/build-tools":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*","@itwin/object-storage-core":"^3.0.4","@itwin/eslint-plugin":"^6.0.0","@types/node":"~20.17.0","@types/sinon":"^17.0.2","@vitest/browser-playwright":"^4.1.10","@vitest/coverage-v8":"^4.1.10","cpx2":"^8.0.0","eslint":"^9.31.0","playwright":"~1.56.1","rimraf":"^6.0.1","sinon":"^17.0.2","typescript":"~5.6.2","vite":"^6.4.3","vitest":"^4.1.10","vite-plugin-static-copy":"2.2.0"},"//dependencies":["NOTE: these dependencies should be only for things that DO NOT APPEAR IN THE API","NOTE: core-frontend should remain UI technology agnostic, so no react/angular dependencies are allowed"],"dependencies":{"@itwin/core-i18n":"workspace:*","@itwin/webgl-compatibility":"workspace:*","@loaders.gl/core":"~4.3.4","@loaders.gl/draco":"~4.3.4","fuse.js":"^3.3.0","wms-capabilities":"0.4.0"}}');
+module.exports = /*#__PURE__*/JSON.parse('{"name":"@itwin/core-frontend","version":"5.13.0-dev.17","description":"iTwin.js frontend components","main":"lib/cjs/core-frontend.js","module":"lib/esm/core-frontend.js","typings":"lib/cjs/core-frontend","license":"MIT","scripts":{"build":"npm run -s copy:public && npm run -s build:cjs && npm run -s build:esm && npm run -s build:workers && npm run -s copy:draco","build:cjs":"npm run -s copy:js:cjs && tsc 1>&2 --outDir lib/cjs","build:esm":"npm run -s copy:js:esm && tsc 1>&2 --module ES2022 --outDir lib/esm","clean":"rimraf -g lib .rush/temp/package-deps*.json","copy:public":"cpx \\"./src/public/**/*\\" ./lib/public","copy:js:cjs":"cpx \\"./src/**/*.js\\" ./lib/cjs","copy:js:esm":"cpx \\"./src/**/*.js\\" ./lib/esm","copy:draco":"cpx \\"./node_modules/@loaders.gl/draco/dist/libs/*\\" ./lib/public/scripts","docs":"betools docs --json=../../generated-docs/core/core-frontend/file.json --tsIndexFile=./core-frontend.ts --onlyJson --excludes=webgl/**/*,**/map/*.d.ts,**/tile/*.d.ts,**/*-css.ts && npm run -s extract","extract":"betools extract --fileExt=ts --extractFrom=./src/test/example-code --recursive --out=../../generated-docs/extract","extract-api":"betools extract-api --entry=core-frontend && npm run extract-extension-api","extract-extension-api":"eslint --no-inline-config -c extraction.eslint.config.js  \\"./src/**/*.ts\\" 1>&2","lint":"eslint \\"./src/**/*.ts\\" 1>&2","lint-fix":"eslint --fix -f visualstudio \\"./src/**/*.ts\\" 1>&2","lint-deprecation":"eslint --fix -f visualstudio --no-inline-config -c ../../common/config/eslint/eslint.config.deprecation-policy.js \\"./src/**/*.ts\\"","pseudolocalize":"betools pseudolocalize --englishDir ./src/public/locales/en --out ./public/locales/en-PSEUDO","test":"npm run build:test-worker && vitest --run","cover":"npm run build:test-worker && vitest --run","build:test-worker":"vite build --config ./src/test/worker/vite.config.mts 1>&2","build:workers":"rimraf lib/workers/webpack && vite build --config ./src/workers/ImdlParser/vite.config.mts 1>&2"},"repository":{"type":"git","url":"https://github.com/iTwin/itwinjs-core.git","directory":"core/frontend"},"keywords":["Bentley","BIM","iModel","digital-twin","iTwin"],"author":{"name":"Bentley Systems, Inc.","url":"http://www.bentley.com"},"peerDependencies":{"@itwin/appui-abstract":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*"},"//devDependencies":["NOTE: All peerDependencies should also be listed as devDependencies since peerDependencies are not considered by npm install","NOTE: All tools used by scripts in this package must be listed as devDependencies"],"devDependencies":{"@bentley/aec-units-schema":"^1.0.3","@bentley/formats-schema":"^1.0.0","@bentley/units-schema":"^1.0.11","@itwin/appui-abstract":"workspace:*","@itwin/build-tools":"workspace:*","@itwin/core-bentley":"workspace:*","@itwin/core-common":"workspace:*","@itwin/core-geometry":"workspace:*","@itwin/core-orbitgt":"workspace:*","@itwin/core-quantity":"workspace:*","@itwin/ecschema-metadata":"workspace:*","@itwin/ecschema-rpcinterface-common":"workspace:*","@itwin/object-storage-core":"^3.0.4","@itwin/eslint-plugin":"^6.0.0","@types/node":"~20.17.0","@types/sinon":"^17.0.2","@vitest/browser-playwright":"^4.1.10","@vitest/coverage-v8":"^4.1.10","cpx2":"^8.0.0","eslint":"^9.31.0","playwright":"~1.56.1","rimraf":"^6.0.1","sinon":"^17.0.2","typescript":"~5.6.2","vite":"^6.4.3","vitest":"^4.1.10","vite-plugin-static-copy":"2.2.0"},"//dependencies":["NOTE: these dependencies should be only for things that DO NOT APPEAR IN THE API","NOTE: core-frontend should remain UI technology agnostic, so no react/angular dependencies are allowed"],"dependencies":{"@itwin/core-i18n":"workspace:*","@itwin/webgl-compatibility":"workspace:*","@loaders.gl/core":"~4.3.4","@loaders.gl/draco":"~4.3.4","fuse.js":"^3.3.0","wms-capabilities":"0.4.0"}}');
 
 /***/ }