setSameSiteMultiAttribute.py (3460B)
1 from cookies.resources.helpers import makeCookieHeader, setNoCacheAndCORSHeaders 2 3 from wptserve.utils import isomorphic_encode 4 5 def main(request, response): 6 """Respond to `/cookie/set/samesite?{value}` by setting the following combination of cookies: 7 1. `samesite_unsupported={value};SameSite=Unsupported;path=/;Secure` 8 2. `samesite_unsupported_none={value};SameSite=Unsupported;SameSite=None;path=/;Secure` 9 3. `samesite_unsupported_lax={value};SameSite=Unsupported;SameSite=Lax;path=/` 10 4. `samesite_unsupported_strict={value};SameSite=Unsupported;SameSite=Strict;path=/` 11 5. `samesite_none_unsupported={value};SameSite=None;SameSite=Unsupported;path=/;Secure` 12 6. `samesite_lax_unsupported={value};SameSite=Lax;SameSite=Unsupported;path=/;Secure` 13 7. `samesite_strict_unsupported={value};SameSite=Strict;SameSite=Unsupported;path=/;Secure` 14 8. `samesite_lax_none={value};SameSite=Lax;SameSite=None;path=/;Secure` 15 9. `samesite_lax_strict={value};SameSite=Lax;SameSite=Strict;path=/` 16 10. `samesite_strict_lax={value};SameSite=Strict;SameSite=Lax;path=/` 17 Then navigate to a page that will post a message back to the opener with the set cookies""" 18 headers = setNoCacheAndCORSHeaders(request, response) 19 value = isomorphic_encode(request.url_parts.query) 20 21 headers.append((b"Content-Type", b"text/html; charset=utf-8")) 22 # Unknown value; single attribute 23 headers.append(makeCookieHeader( 24 b"samesite_unsupported", value, {b"SameSite":b"Unsupported", b"path":b"/", b"Secure":b""})) 25 26 # Multiple attributes; first attribute unknown 27 headers.append(makeCookieHeader( 28 b"samesite_unsupported_none", value, {b"SameSite":b"Unsupported", b"SameSite":b"None", b"path":b"/", b"Secure":b""})) 29 headers.append(makeCookieHeader( 30 b"samesite_unsupported_lax", value, {b"SameSite":b"Unsupported", b"SameSite":b"Lax", b"path":b"/"})) 31 headers.append(makeCookieHeader( 32 b"samesite_unsupported_strict", value, {b"SameSite":b"Unsupported", b"SameSite":b"Strict", b"path":b"/"})) 33 34 # Multiple attributes; second attribute unknown 35 headers.append(makeCookieHeader( 36 b"samesite_none_unsupported", value, {b"SameSite":b"None", b"SameSite":b"Unsupported", b"path":b"/", b"Secure":b""})) 37 headers.append(makeCookieHeader( 38 b"samesite_lax_unsupported", value, {b"SameSite":b"Lax", b"SameSite":b"Unsupported", b"path":b"/", b"Secure":b""})) 39 headers.append(makeCookieHeader( 40 b"samesite_strict_unsupported", value, {b"SameSite":b"Strict", b"SameSite":b"Unsupported", b"path":b"/", b"Secure":b""})) 41 42 # Multiple attributes; both known 43 headers.append(makeCookieHeader( 44 b"samesite_lax_none", value, {b"SameSite":b"Lax", b"SameSite":b"None", b"path":b"/", b"Secure":b""})) 45 headers.append(makeCookieHeader( 46 b"samesite_lax_strict", value, {b"SameSite":b"Lax", b"SameSite":b"Strict", b"path":b"/"})) 47 headers.append(makeCookieHeader( 48 b"samesite_strict_lax", value, {b"SameSite":b"Strict", b"SameSite":b"Lax", b"path":b"/"})) 49 50 document = b""" 51 <!DOCTYPE html> 52 <script> 53 // A same-site navigation, which should attach all cookies including SameSite ones. 54 // This is necessary because this page may have been reached via a cross-site navigation, so 55 // we might not have access to some SameSite cookies from here. 56 window.location = "../samesite/resources/echo-cookies.html"; 57 </script> 58 """ 59 60 return headers, document