tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

fetch-no-credentials.https.html (1466B)


      1 <!DOCTYPE html>
      2 <meta charset="utf-8">
      3 <script src="/resources/testharness.js"></script>
      4 <script src="/resources/testharnessreport.js"></script>
      5 <script src="/common/get-host-info.sub.js"></script>
      6 <script src="helper.js" type="module"></script>
      7 
      8 <script type="module">
      9  import { documentHasCookie, expireCookie, waitForCookie, addCookieAndSessionCleanup, setupShardedServerState, configureServer, crossSiteFetch } from "./helper.js";
     10 
     11  promise_test(async t => {
     12    const testId = await setupShardedServerState();
     13    const expectedCookieAndValue = "auth_cookie=abcdef0123";
     14    const expectedCookieAndAttributes = `${expectedCookieAndValue};Domain=${location.hostname};Path=/device-bound-session-credentials`;
     15    addCookieAndSessionCleanup(t);
     16 
     17    // Prompt starting a session, and wait until registration completes.
     18    const loginResponse = await fetch('login.py');
     19    assert_equals(loginResponse.status, 200);
     20    await waitForCookie(expectedCookieAndValue, /*expectCookie=*/true);
     21 
     22    // Expire the cookies
     23    expireCookie(expectedCookieAndAttributes);
     24    let statusCode = await crossSiteFetch(get_host_info().HTTPS_NOTSAMESITE_ORIGIN, `${location.origin}/device-bound-session-credentials/verify_authenticated.py` , {credentials: "omit"});
     25    assert_equals(statusCode, 403);
     26 
     27    // We should not have refreshed.
     28    assert_false(documentHasCookie(expectedCookieAndValue));
     29  }, "A cross-site fetch without credentials should not refresh");
     30 </script>