tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

multiple-credentials.https.html (3184B)


      1 <!DOCTYPE html>
      2 <meta charset="utf-8">
      3 <script src="/resources/testharness.js"></script>
      4 <script src="/resources/testharnessreport.js"></script>
      5 <script src="helper.js" type="module"></script>
      6 
      7 <script type="module">
      8  import { expireCookie, documentHasCookie, waitForCookie, addCookieAndSessionCleanup, setupShardedServerState, configureServer } from "./helper.js";
      9 
     10  promise_test(async t => {
     11    const testId = await setupShardedServerState();
     12    const expectedCookieAndValue1 = "auth_cookie=abcdef0123";
     13    const expectedAttributes1 = `Domain=${location.hostname};Path=/device-bound-session-credentials`;
     14    const expectedCookieAndAttributes1 = `${expectedCookieAndValue1};${expectedAttributes1}`;
     15    const expectedCookieAndValue2 = "other_cookie=ghijkl4567";
     16    const expectedAttributes2 = `Domain=${location.hostname};Path=/device-bound-session-credentials`;
     17    const expectedCookieAndAttributes2 = `${expectedCookieAndValue2};${expectedAttributes2}`;
     18    addCookieAndSessionCleanup(t);
     19 
     20    // Configure server to set two cookies in the session instruction credentials.
     21    await configureServer({ cookieDetails: [
     22      { nameAndValue: expectedCookieAndValue2, attributes: expectedAttributes2 },
     23      { nameAndValue: expectedCookieAndValue1, attributes: expectedAttributes1 },
     24    ]});
     25 
     26    // Prompt starting a session, and wait until registration completes.
     27    const loginResponse = await fetch('login.py');
     28    assert_equals(loginResponse.status, 200);
     29    await waitForCookie(expectedCookieAndValue1, /*expectCookie=*/true);
     30    await waitForCookie(expectedCookieAndValue2, /*expectCookie=*/true);
     31 
     32    // Confirm that requests have the cookies set.
     33    const authResponse = await fetch('verify_authenticated.py', {
     34      method: 'POST',
     35      body: expectedCookieAndValue1
     36    });
     37    assert_equals(authResponse.status, 200);
     38    const alternateAuthResponse = await fetch('verify_authenticated.py', {
     39      method: 'POST',
     40      body: expectedCookieAndValue2
     41    });
     42    assert_equals(alternateAuthResponse.status, 200);
     43 
     44    async function triggerRefreshAndCheckBothCookies() {
     45      const authResponseAfterExpiry = await fetch('verify_authenticated.py');
     46      assert_equals(authResponseAfterExpiry.status, 200);
     47      assert_true(documentHasCookie(expectedCookieAndValue1));
     48      assert_true(documentHasCookie(expectedCookieAndValue2));
     49    }
     50    // Confirm that expiring the cookies still leads to a request with the cookie set (refresh occurs).
     51    // Just cookie 1.
     52    expireCookie(expectedCookieAndAttributes1);
     53    assert_false(documentHasCookie(expectedCookieAndValue1));
     54    await triggerRefreshAndCheckBothCookies();
     55 
     56    // Just cookie 2.
     57    expireCookie(expectedCookieAndAttributes2);
     58    assert_false(documentHasCookie(expectedCookieAndValue2));
     59    await triggerRefreshAndCheckBothCookies();
     60 
     61    // Both cookies.
     62    expireCookie(expectedCookieAndAttributes1);
     63    expireCookie(expectedCookieAndAttributes2);
     64    assert_false(documentHasCookie(expectedCookieAndValue1));
     65    assert_false(documentHasCookie(expectedCookieAndValue2));
     66    await triggerRefreshAndCheckBothCookies();
     67  }, "A session can have multiple credentials set");
     68 </script>