[Copilot]

Opening the Authentication dialog crashed with System.MissingMethodException: Method not found: 'Avalonia.Data.IBinding Avalonia.AvaloniaObject.get_Item(Avalonia.Data.IndexerDescriptor)'. WebView.Avalonia/WebView.Avalonia.Desktop are pinned at v11.0.0.1 (built against Avalonia 11) and are no longer maintained, so they became binary-incompatible once the app moved to Avalonia 12.1.1.

Package swap

• Replaced WebView.Avalonia / WebView.Avalonia.Desktop with the official Avalonia.Controls.WebView 12.1.0 package (built for Avalonia 12) in Directory.Packages.props and YoutubeDownloader.csproj
• Simplified the TrimmerRootAssembly entries to the single new assembly

Initialization cleanup

• Removed UseDesktopWebView() from Program.cs — no longer required by the new package
• Removed AvaloniaWebViewBuilder.Initialize(...) from App.axaml.cs — private-mode config now lives on the control itself

AuthSetupView migration

Migrated from the old WebView control/API to the new NativeWebView:

- <WebView x:Name="WebBrowser"
-          Loaded="WebBrowser_OnLoaded"
-          NavigationStarting="WebBrowser_OnNavigationStarting"
-          WebViewCreated="WebBrowser_OnWebViewCreated" />
+ <NativeWebView x:Name="WebBrowser"
+                Loaded="WebBrowser_OnLoaded"
+                NavigationStarted="WebBrowser_OnNavigationStarted"
+                EnvironmentRequested="WebBrowser_OnEnvironmentRequested" />

• Url → Source
• WebViewCreated (WebView2-specific CoreWebView2 access) → EnvironmentRequested, setting private-mode flags per platform (IsInPrivateModeEnabled on Windows, NonPersistentDataStore on macOS, EphemeralDataManager on Linux)
• Cookie retrieval/deletion now goes through NativeWebView.TryGetCookieManager(), which returns System.Net.Cookie directly (dropped the manual ToSystemNetCookie() conversion); cookie reset uses GetCookiesAsync() + DeleteCookie(cookie) per-cookie since the new manager has no DeleteAllCookies()

• Fixes Authentication doesn't work. System.MissingMethodException: Method not found: 'Avalonia.Data.IBinding Avalonia.AvaloniaObject.get_Item(Avalonia.Data.IndexerDescriptor)' #886

[Copilot]

🟡 Changes recommended

Five moderate-severity findings remain in AuthSetupView.axaml.cs.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Migrates authentication from the incompatible Avalonia 11 WebView packages to the Avalonia 12-compatible NativeWebView.

Changes:

• Replaces legacy packages and initialization.
• Migrates authentication navigation, private-mode configuration, and cookie handling.
• Updates trimming configuration.

File summaries

File	Summary and final findings
YoutubeDownloader/YoutubeDownloader.csproj	Updates the WebView package reference and trimming configuration.
YoutubeDownloader/Views/Dialogs/AuthSetupView.axaml.cs	Migrates WebView environment and cookie handling. Moderate findings: unscoped cookie retrieval (3 votes), missing Windows UI hardening (2 votes), non-private Linux WPE storage (1 vote), unsupported WebView1 fallback (1 vote), and asynchronous cookie cleanup race (1 vote).
YoutubeDownloader/Views/Dialogs/AuthSetupView.axaml	Replaces the legacy control and events with NativeWebView.
YoutubeDownloader/Program.cs	Removes obsolete desktop WebView initialization.
YoutubeDownloader/App.axaml.cs	Removes obsolete global WebView configuration.
Directory.Packages.props	Updates WebView package versions.

Review details

Suppressed comments (3)

YoutubeDownloader/Views/Dialogs/AuthSetupView.axaml.cs:45

• The 12.1.0 adapter selects WPE on Linux whenever it is available, but this switch only configures GtkWebViewEnvironmentRequestedEventArgs; LinuxWpeWebViewEnvironmentRequestedEventArgs has no ephemeral-data setting and therefore uses the default persistent network session. Authentication can consequently leave Google/YouTube cookies on disk despite the intended private mode. Please either force the GTK backend before applying EphemeralDataManager or otherwise provide a non-persistent WPE configuration.

        switch (args)
        {
            case WindowsWebView2EnvironmentRequestedEventArgs windowsArgs:
                windowsArgs.IsInPrivateModeEnabled = true;
                break;
            case AppleWKWebViewEnvironmentRequestedEventArgs appleArgs:
                appleArgs.NonPersistentDataStore = true;
                break;
            case GtkWebViewEnvironmentRequestedEventArgs gtkArgs:
                gtkArgs.EphemeralDataManager = true;
                break;

YoutubeDownloader/Views/Dialogs/AuthSetupView.axaml.cs:55

• NativeWebView falls back to the Windows WebView1 adapter when WebView2 is unavailable, and that adapter does not implement TryGetCookieManager(). This early return then allows the login page to display but never copies cookies into DataContext, so authentication can never become active on those Windows installations. Please reject/report that unsupported backend or add a supported cookie path instead of silently skipping the auth flow.

        if (WebBrowser.TryGetCookieManager() is not { } cookieManager)
            return;

YoutubeDownloader/Views/Dialogs/AuthSetupView.axaml.cs:67

• NavigationStarted is raised synchronously, but this handler yields at await GetCookiesAsync(), so the login request is allowed to proceed while the old cookies are still present. Google can process that request before the subsequent DeleteCookie calls finish, making the promised logout/reset unreliable and potentially reusing the previous session. Clear the cookies before assigning Source, or cancel this navigation and only restart it after cleanup completes.

            foreach (var cookie in await cookieManager.GetCookiesAsync())
                cookieManager.DeleteCookie(cookie);

• Files reviewed: 6/6 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Tyrrrz]

@copilot

[Copilot]

🟡 Changes recommended

Cookie deletion races with login navigation, allowing the previous session to be reused.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Balanced