form-post-blank-reload.https.html (2714B)
1 <!DOCTYPE html> 2 <meta charset="utf-8"/> 3 <script src="/resources/testharness.js"></script> 4 <script src="/resources/testharnessreport.js"></script> 5 <script src="/cookies/resources/cookie-helper.sub.js"></script> 6 <script> 7 // This test creates a form whose submission POSTs to the page postToParent.py 8 // (on the specified origin) in a popup window. The popup sends a postMessage 9 // event back to its opener (i.e., here) with the cookies it received, which 10 // we verify against expectedStatus. Then, the test sends a message to the 11 // popup, telling it to reload itself via window.location.reload(). Again, 12 // the popup posts a message back here with the cookies it received. These 13 // cookies are verified against expectedStatusReload. 14 function create_test(origin, target, expectedStatus, expectedStatusReload, title) { 15 promise_test(t => { 16 var value = "" + Math.random(); 17 return resetSameSiteCookies(origin, value) 18 .then(_ => { 19 return new Promise((resolve, reject) => { 20 var f = document.createElement('form'); 21 f.action = target + "/cookies/resources/postToParent.py"; 22 f.target = "_blank"; 23 f.method = "POST"; 24 f.rel = "opener"; 25 26 var reloaded = false; 27 var msgHandler = e => { 28 try { 29 verifySameSiteCookieState(reloaded ? expectedStatusReload : expectedStatus, value, e.data, DomSameSiteStatus.SAME_SITE); 30 } catch (e) { 31 reject(e); 32 } 33 34 if (reloaded) { 35 window.removeEventListener("message", msgHandler); 36 e.source.close(); 37 resolve("Popup received the cookie."); 38 } else { 39 reloaded = true; 40 e.source.postMessage("reload", "*"); 41 } 42 }; 43 window.addEventListener("message", msgHandler); 44 45 document.body.appendChild(f); 46 f.submit(); 47 }); 48 }); 49 }, title); 50 } 51 52 // The reload status is always strictly same-site because this is a site-initiated reload, as opposed to a reload triggered by a user interface element. 53 create_test(SECURE_ORIGIN, SECURE_ORIGIN, SameSiteStatus.STRICT, SameSiteStatus.STRICT, "Reloaded same-host top-level form POSTs are strictly same-site"); 54 create_test(SECURE_SUBDOMAIN_ORIGIN, SECURE_SUBDOMAIN_ORIGIN, SameSiteStatus.STRICT, SameSiteStatus.STRICT, "Reloaded subdomain top-level form POSTs are strictly same-site"); 55 create_test(SECURE_CROSS_SITE_ORIGIN, SECURE_CROSS_SITE_ORIGIN, SameSiteStatus.CROSS_SITE, SameSiteStatus.STRICT, "Reloaded cross-site top-level form POSTs are strictly same-site"); 56 </script>