schemeful-websockets.sub.tentative.html (2553B)
1 <!doctype html> 2 <html> 3 <head> 4 <meta charset=utf-8> 5 <script src="/resources/testharness.js"></script> 6 <script src="/resources/testharnessreport.js"></script> 7 <script src="/cookies/resources/testharness-helpers.js"></script> 8 <script src="/cookies/resources/cookie-helper.sub.js"></script> 9 </head> 10 <body> 11 <div id=log></div> 12 <script> 13 promise_test(async function (t) { 14 var value = "" + Math.random(); 15 document.cookie = `schemeful_same_site_websockets_strict=${value}; sameSite=strict; path=/`; 16 document.cookie = `schemeful_same_site_websockets_lax=${value}; sameSite=lax; path=/`; 17 await credFetch(SECURE_ORIGIN + "/cookies/resources/setSameSiteNone.py?" + value) 18 t.add_cleanup(async function() { 19 await credFetch(origin + "/cookies/resources/drop.py?name=" + "schemeful_same_site_websockets_strict"); 20 await credFetch(origin + "/cookies/resources/drop.py?name=" + "schemeful_same_site_websockets_lax"); 21 await credFetch(SECURE_ORIGIN + "/cookies/resources/dropSameSiteNone.py"); 22 }); 23 24 var ws = new WebSocket("ws://{{host}}:{{ports[ws][0]}}/echo-cookie"); 25 return new Promise((resolve, reject) => { 26 ws.onclose = t.step_func_done(function () { 27 assert_unreached("'close' should not fire before 'open'."); 28 }); 29 ws.onmessage = t.step_func(function (e) { 30 ws.onclose = null; 31 ws.close(); 32 // Same-scheme WebSockets should get Lax and Strict cookies. 33 var strictRegex = new RegExp("schemeful_same_site_websockets_strict=" + value); 34 var laxRegex = new RegExp("schemeful_same_site_websockets_lax=" + value); 35 assert_regexp_match(e.data, strictRegex, "Same-scheme strict"); 36 assert_regexp_match(e.data, laxRegex, "Same-scheme strict"); 37 38 var ws2 = new WebSocket("wss://{{host}}:{{ports[wss][0]}}/echo-cookie"); 39 ws2.onclose = t.step_func_done(function () { 40 assert_unreached("'close' should not fire before 'open'."); 41 }); 42 ws2.onmessage = t.step_func(function (e2) { 43 ws2.onclose = null; 44 ws2.close(); 45 // Cross-scheme WebSockets should only get samesite_none. 46 var noneRegex = new RegExp("samesite_none_secure=" + value); 47 assert_regexp_match(e2.data, noneRegex, "Cross-scheme none"); 48 assert_false(strictRegex.test(e2.data), "Cross-scheme strict"); 49 assert_false(laxRegex.test(e2.data), "Cross-scheme lax"); 50 resolve(); 51 }); 52 }); 53 }); 54 }, "Cross-scheme WebSockets are cross-site"); 55 </script> 56 </body> 57 </html>