fetch-no-credentials.https.html (1466B)
1 <!DOCTYPE html> 2 <meta charset="utf-8"> 3 <script src="/resources/testharness.js"></script> 4 <script src="/resources/testharnessreport.js"></script> 5 <script src="/common/get-host-info.sub.js"></script> 6 <script src="helper.js" type="module"></script> 7 8 <script type="module"> 9 import { documentHasCookie, expireCookie, waitForCookie, addCookieAndSessionCleanup, setupShardedServerState, configureServer, crossSiteFetch } from "./helper.js"; 10 11 promise_test(async t => { 12 const testId = await setupShardedServerState(); 13 const expectedCookieAndValue = "auth_cookie=abcdef0123"; 14 const expectedCookieAndAttributes = `${expectedCookieAndValue};Domain=${location.hostname};Path=/device-bound-session-credentials`; 15 addCookieAndSessionCleanup(t); 16 17 // Prompt starting a session, and wait until registration completes. 18 const loginResponse = await fetch('login.py'); 19 assert_equals(loginResponse.status, 200); 20 await waitForCookie(expectedCookieAndValue, /*expectCookie=*/true); 21 22 // Expire the cookies 23 expireCookie(expectedCookieAndAttributes); 24 let statusCode = await crossSiteFetch(get_host_info().HTTPS_NOTSAMESITE_ORIGIN, `${location.origin}/device-bound-session-credentials/verify_authenticated.py` , {credentials: "omit"}); 25 assert_equals(statusCode, 403); 26 27 // We should not have refreshed. 28 assert_false(documentHasCookie(expectedCookieAndValue)); 29 }, "A cross-site fetch without credentials should not refresh"); 30 </script>