setcookie-navigation.https.html (5017B)
1 <!DOCTYPE html> 2 <meta charset="utf-8"> 3 <meta name="timeout" content="long"> 4 <script src="/resources/testharness.js"></script> 5 <script src="/resources/testharnessreport.js"></script> 6 <script src="/cookies/resources/cookie-helper.sub.js"></script> 7 <script> 8 // Asserts that cookies are present or not present (according to `expectation`) 9 // in the cookie string `cookies` with the correct names and value. 10 function assert_cookies_present(cookies, value, expected_cookie_names, expectation) { 11 for (name of expected_cookie_names) { 12 let re = new RegExp("(?:^|; )" + name + "=" + value + "(?:$|;)"); 13 let assertion = expectation ? assert_true : assert_false; 14 assertion(re.test(cookies), "`" + name + "=" + value + "` in cookies"); 15 } 16 } 17 18 // Navigate from ORIGIN to |origin_to|, expecting the navigation to set SameSite 19 // cookies on |origin_to|. 20 function navigate_test(method, origin_to, title) { 21 promise_test(async function(t) { 22 // The cookies don't need to be cleared on each run because |value| is 23 // a new random value on each run, so on each run we are overwriting and 24 // checking for a cookie with a different random value. 25 let value = "" + Math.random(); 26 let url_from = SECURE_ORIGIN + "/cookies/samesite/resources/navigate.html"; 27 let url_to = origin_to + "/cookies/resources/setSameSite.py?" + value; 28 var w = window.open(url_from); 29 await wait_for_message('READY', SECURE_ORIGIN); 30 assert_equals(SECURE_ORIGIN, window.origin); 31 assert_equals(SECURE_ORIGIN, w.origin); 32 let command = (method === "POST") ? "post-form" : "navigate"; 33 w.postMessage({ type: command, url: url_to }, "*"); 34 let message = await wait_for_message('COOKIES_SET', origin_to); 35 let samesite_cookie_names = ['samesite_strict', 'samesite_lax', 'samesite_none', 'samesite_unspecified']; 36 assert_cookies_present(message.data.cookies, value, samesite_cookie_names, true); 37 w.close(); 38 }, title); 39 } 40 41 // Opens a page on origin SECURE_ORIGIN containing an iframe on `iframe_origin_from`, 42 // then navigates that iframe to `iframe_origin_to`. Expects that navigation to set 43 // some subset of SameSite cookies. 44 function navigate_iframe_test(iframe_origin_from, iframe_origin_to, cross_site, title) { 45 promise_test(async function(t) { 46 // The cookies don't need to be cleared on each run because |value| is 47 // a new random value on each run, so on each run we are overwriting and 48 // checking for a cookie with a different random value. 49 let value = "" + Math.random(); 50 let parent_url = SECURE_ORIGIN + "/cookies/samesite/resources/navigate-iframe.html"; 51 let iframe_url_from = iframe_origin_from + "/cookies/samesite/resources/navigate.html"; 52 let iframe_url_to = iframe_origin_to + "/cookies/resources/setSameSite.py?" + value; 53 var w = window.open(parent_url); 54 await wait_for_message('LOADED', SECURE_ORIGIN); 55 assert_equals(SECURE_ORIGIN, window.origin); 56 assert_equals(SECURE_ORIGIN, w.origin); 57 // Navigate the frame to its starting location. 58 w.postMessage({ type: 'initialize-iframe', url: iframe_url_from }, '*'); 59 await wait_for_message('FRAME_READY', SECURE_ORIGIN); 60 // Have the frame navigate itself, possibly cross-site. 61 w.postMessage({ type: 'navigate-iframe', url: iframe_url_to }, '*'); 62 let message = await wait_for_message('FRAME_COOKIES_SET', SECURE_ORIGIN); 63 // Check for the proper cookies. 64 let samesite_none_cookies = ['samesite_none']; 65 let samesite_cookies = ['samesite_strict', 'samesite_lax', 'samesite_unspecified']; 66 assert_cookies_present(message.data.cookies, value, samesite_none_cookies, true); 67 assert_cookies_present(message.data.cookies, value, samesite_cookies, !cross_site); 68 w.close(); 69 }, title); 70 } 71 72 navigate_test("GET", SECURE_ORIGIN, "Same-site top-level navigation should be able to set SameSite=* cookies."); 73 navigate_test("GET", SECURE_CROSS_SITE_ORIGIN, "Cross-site top-level navigation should be able to set SameSite=* cookies."); 74 navigate_test("POST", SECURE_ORIGIN, "Same-site top-level POST should be able to set SameSite=* cookies."); 75 navigate_test("POST", SECURE_CROSS_SITE_ORIGIN, "Cross-site top-level POST should be able to set SameSite=* cookies."); 76 77 navigate_iframe_test(SECURE_ORIGIN, SECURE_ORIGIN, false, "Same-site to same-site iframe navigation should be able to set SameSite=* cookies."); 78 navigate_iframe_test(SECURE_CROSS_SITE_ORIGIN, SECURE_ORIGIN, true, "Cross-site to same-site iframe navigation should only be able to set SameSite=None cookies."); 79 navigate_iframe_test(SECURE_ORIGIN, SECURE_CROSS_SITE_ORIGIN, true, "Same-site to cross-site-site iframe navigation should only be able to set SameSite=None cookies."); 80 navigate_iframe_test(SECURE_CROSS_SITE_ORIGIN, SECURE_CROSS_SITE_ORIGIN, true, "Cross-site to cross-site iframe navigation should only be able to set SameSite=None cookies."); 81 </script>