tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

clear-site-data.https.html (2936B)


      1 <!DOCTYPE html>
      2 <meta charset="utf-8">
      3 <script src="/resources/testharness.js"></script>
      4 <script src="/resources/testharnessreport.js"></script>
      5 <script src="helper.js" type="module"></script>
      6 
      7 <script type="module">
      8  import { expireCookie, documentHasCookie, waitForCookie, addCookieAndSessionCleanup, setupShardedServerState } from "./helper.js";
      9 
     10  promise_test(async t => {
     11    const testId = await setupShardedServerState();
     12    const expectedCookieAndValue = "auth_cookie=abcdef0123";
     13    const expectedCookieAndAttributes = `${expectedCookieAndValue};Domain=${location.hostname};Path=/device-bound-session-credentials`;
     14    addCookieAndSessionCleanup(t);
     15 
     16    // Prompt starting a session, and wait until registration completes.
     17    const loginResponse = await fetch('login.py');
     18    assert_equals(loginResponse.status, 200);
     19    await waitForCookie(expectedCookieAndValue, /*expectCookie=*/true);
     20 
     21    // The server ends the session.
     22    const endSessionResponse = await fetch('end_session_via_clear_site_data.py');
     23    assert_equals(endSessionResponse.status, 200);
     24    // Need to set up the state again because all cookies were cleared.
     25    await setupShardedServerState({testId});
     26 
     27    // Expire the cookie, and confirm it does not get refreshed.
     28    expireCookie(expectedCookieAndAttributes);
     29    assert_false(documentHasCookie(expectedCookieAndValue));
     30    const authResponse = await fetch('verify_authenticated.py');
     31    assert_equals(authResponse.status, 403);
     32    assert_false(documentHasCookie(expectedCookieAndValue));
     33  }, "A session ended with Clear-Site-Data: 'cookies' does not refresh cookies");
     34 
     35  promise_test(async t => {
     36    const testId = await setupShardedServerState();
     37    const expectedCookieAndValue = "auth_cookie=abcdef0123";
     38    const expectedCookieAndAttributes = `${expectedCookieAndValue};Domain=${location.hostname};Path=/device-bound-session-credentials`;
     39    addCookieAndSessionCleanup(t);
     40 
     41    // Prompt starting a session, and wait until registration completes.
     42    const loginResponse = await fetch('login.py');
     43    assert_equals(loginResponse.status, 200);
     44    await waitForCookie(expectedCookieAndValue, /*expectCookie=*/true);
     45 
     46    // The server ends the session.
     47    const endSessionResponse = await fetch('end_session_via_clear_site_data.py', {method: 'POST', body: '"storage"'});
     48    assert_equals(endSessionResponse.status, 200);
     49    // Need to set up the state again because all cookies were cleared.
     50    await setupShardedServerState({testId});
     51 
     52    // Expire the cookie, and confirm it does not get refreshed.
     53    expireCookie(expectedCookieAndAttributes);
     54    assert_false(documentHasCookie(expectedCookieAndValue));
     55    const authResponse = await fetch('verify_authenticated.py');
     56    assert_equals(authResponse.status, 403);
     57    assert_false(documentHasCookie(expectedCookieAndValue));
     58  }, "A session ended with Clear-Site-Data: 'storage' does not refresh cookies")
     59 </script>