attributes.www.sub.html (4860B)
1 <!doctype html> 2 <html> 3 4 <head> 5 <meta charset=utf-8> 6 <title>Test cookie attribute size restrictions</title> 7 <meta name=help href="https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4"> 8 <meta name="timeout" content="long"> 9 <script src="/resources/testharness.js"></script> 10 <script src="/resources/testharnessreport.js"></script> 11 <script src="/resources/testdriver.js"></script> 12 <script src="/resources/testdriver-vendor.js"></script> 13 <script src="/cookies/resources/cookie-test.js"></script> 14 </head> 15 16 <body> 17 <div id=log></div> 18 <script> 19 const host = "{{host}}"; 20 const attrSizeTests = [ 21 { 22 cookie: `test=1; path=/cookies/size; path=/cookies/siz${"e".repeat(1024)}`, 23 expected: "test=1", 24 name: "Too long path attribute (>1024 bytes) is ignored; previous valid path wins.", 25 defaultPath: false, 26 }, 27 { 28 cookie: `test=2; path=/cookies/siz${"e".repeat(1024)}; path=/cookies/size`, 29 expected: "test=2", 30 name: "Too long path attribute (>1024 bytes) is ignored; next valid path wins.", 31 defaultPath: false, 32 }, 33 { 34 // Look for the cookie using the default path to ensure that it 35 // doesn't show up if the path attribute actually takes effect. 36 cookie: `test=3; path=/${"a".repeat(1023)};`, 37 expected: "", 38 name: "Max size path attribute (1024 bytes) is not ignored", 39 }, 40 { 41 // Look for the cookie using the default path to ensure that it 42 // shows up if the path is ignored. 43 cookie: `test=4; path=/${"a".repeat(1024)};`, 44 expected: "test=4", 45 name: "Too long path attribute (>1024 bytes) is ignored", 46 }, 47 { 48 // This page opens on the www subdomain, so we set domain to {{host}} 49 // to see if anything works as expected. Using a valid domain other 50 // than ${host} will cause the cookie to fail to be set. 51 52 // NOTE: the domain we use for testing here is technically invalid per 53 // the RFCs that define the format of domain names, but currently 54 // neither RFC6265bis or the major browsers enforce those restrictions 55 // when parsing cookie domain attributes. If that changes, update these 56 // tests. 57 cookie: `test=5; domain=${host}; domain=${"a".repeat(1024)}.com`, 58 expected: "test=5", 59 name: "Too long domain attribute (>1024 bytes) is ignored; previous valid domain wins.", 60 }, 61 { 62 cookie: `test=6; domain=${"a".repeat(1024)}.com; domain=${host}`, 63 expected: "test=6", 64 name: "Too long domain attribute (>1024 bytes) is ignored; next valid domain wins.", 65 }, 66 { 67 cookie: `test=7; domain=${"a".repeat(1020)}.com;`, 68 expected: "", 69 name: "Max size domain attribute (1024 bytes) is not ignored" 70 }, 71 { 72 cookie: `test=8; domain=${"a".repeat(1021)}.com;`, 73 expected: "test=8", 74 name: "Too long domain attribute (>1024 bytes) is ignored" 75 }, 76 { 77 cookie: cookieStringWithNameAndValueLengths(2048, 2048) + 78 `; domain=${"a".repeat(1020)}.com; domain=${host}`, 79 expected: cookieStringWithNameAndValueLengths(2048, 2048), 80 name: "Set cookie with max size name/value pair and max size attribute value", 81 }, 82 { 83 // RFC6265bis doesn't specify a maximum size of the entire Set-Cookie 84 // header, although some browsers do 85 cookie: cookieStringWithNameAndValueLengths(2048, 2048) + 86 `; domain=${"a".repeat(1020)}.com` + 87 `; domain=${"a".repeat(1020)}.com` + 88 `; domain=${"a".repeat(1020)}.com` + 89 `; domain=${"a".repeat(1020)}.com; domain=${host}`, 90 expected: cookieStringWithNameAndValueLengths(2048, 2048), 91 name: "Set cookie with max size name/value pair and multiple max size attributes (>8k bytes total)", 92 }, 93 { 94 cookie: `test=11; max-age=${"1".repeat(1024)};`, 95 expected: "test=11", 96 name: "Max length Max-Age attribute value (1024 bytes) doesn't cause cookie rejection" 97 }, 98 { 99 cookie: `test=12; max-age=${"1".repeat(1025)};`, 100 expected: "test=12", 101 name: "Too long Max-Age attribute value (>1024 bytes) doesn't cause cookie rejection" 102 }, 103 { 104 cookie: `test=13; max-age=-${"1".repeat(1023)};`, 105 expected: "", 106 name: "Max length negative Max-Age attribute value (1024 bytes) doesn't get ignored" 107 }, 108 { 109 cookie: `test=14; max-age=-${"1".repeat(1024)};`, 110 expected: "test=14", 111 name: "Too long negative Max-Age attribute value (>1024 bytes) gets ignored" 112 }, 113 ]; 114 115 for (const test of attrSizeTests) { 116 httpCookieTest(test.cookie, test.expected, test.name, test.defaultPath); 117 } 118 </script> 119 </body> 120 121 </html>