tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

split-cache.html (5494B)


      1 <!doctype html>
      2 <html>
      3 <head>
      4  <meta charset="utf-8">
      5  <title>HTTP Cache - Partioning by site</title>
      6  <meta name="help" href="https://fetch.spec.whatwg.org/#http-cache-partitions">
      7  <script src="/resources/testharness.js"></script>
      8  <script src="/resources/testharnessreport.js"></script>
      9  <script src="/common/utils.js"></script>
     10  <script src="/common/get-host-info.sub.js"></script>
     11  <script src="http-cache.js"></script>
     12 </head>
     13 <body>
     14 <script>
     15 const host = get_host_info();
     16 
     17 // We run this entire test four times, varying the following two booleans:
     18 // - is_cross_site_test, which controls whether the popup is cross-site.
     19 // - load_resource_in_iframe, which controls whether the popup loads the
     20 //     resource in an iframe or the top-level frame. Note that the iframe is
     21 //     always same-site to the opener.
     22 function performFullTest(is_cross_site_test, load_resource_in_iframe, name) {
     23  const POPUP_HTTP_ORIGIN = is_cross_site_test ? host.HTTP_NOTSAMESITE_ORIGIN : host.HTTP_ORIGIN
     24  const LOCAL_HTTP_ORIGIN = host.HTTP_ORIGIN
     25 
     26  const popupBaseURL = POPUP_HTTP_ORIGIN + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
     27  const localBaseURL = LOCAL_HTTP_ORIGIN + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
     28 
     29  // Note: Navigation requests are requested with credentials. Make sure the
     30  // fetch requests are also requested with credentials. This ensures passing
     31  // this test is not simply the consequence of discriminating anonymous and
     32  // credentialled request in the HTTP cache.
     33  //
     34  // See https://github.com/whatwg/fetch/issues/1253
     35  var test = {
     36    requests: [
     37      {
     38        response_headers: [
     39          ["Expires", (30 * 24 * 60 * 60)],
     40          ["Access-Control-Allow-Origin", POPUP_HTTP_ORIGIN],
     41        ],
     42        base_url: localBaseURL,
     43        credentials: "include",
     44      },
     45      {
     46        response_headers: [
     47          ["Access-Control-Allow-Origin", POPUP_HTTP_ORIGIN],
     48        ],
     49        base_url: localBaseURL,
     50        credentials: "include",
     51      },
     52      {
     53        request_headers: [
     54          ["Cache-Control", "no-cache"]
     55        ],
     56        response_headers: [
     57          ["Access-Control-Allow-Origin", POPUP_HTTP_ORIGIN],
     58        ],
     59        // If the popup's request was a cache hit, we would only expect 2
     60        // requests to the server. If it was a cache miss, we would expect 3.
     61        // load_resource_in_iframe does not affect the expectation as, even
     62        // though the iframe (if present) is same-site, we expect a cache miss
     63        // when the popup's top-level frame is a different site.
     64        expected_response_headers: [
     65          ["server-request-count", is_cross_site_test ? "3" : "2"]
     66        ],
     67        base_url: localBaseURL,
     68        credentials: "include",
     69      }
     70    ]
     71  }
     72 
     73  var uuid = token()
     74  var local_requests = expandTemplates(test)
     75  var fetchFns = makeFetchFunctions(local_requests, uuid)
     76 
     77  var popup_requests = expandTemplates(test)
     78 
     79  // Request the resource with a long cache expiry
     80  function local_fetch() {
     81    return fetchFns[0].code(0)
     82  }
     83 
     84  function popup_fetch() {
     85    return new Promise(function(resolve, reject) {
     86      var relativeUrl = load_resource_in_iframe
     87          ? "resources/split-cache-popup-with-iframe.html"
     88          : "resources/split-cache-popup.html";
     89      var win = window.open(popupBaseURL + relativeUrl);
     90 
     91      // Post a message to initiate the popup's request and give the necessary
     92      // information. Posted repeatedly to account for dropped messages as the
     93      // popup is loading.
     94      function postMessage(event) {
     95        var payload = {
     96          index: 1,
     97          requests: popup_requests,
     98          uuid: uuid
     99        }
    100        win.postMessage(payload, POPUP_HTTP_ORIGIN)
    101      }
    102      var messagePoster = setInterval(postMessage, 100)
    103 
    104      // Listen for the result
    105      function messageListener(event) {
    106        if (event.origin !== POPUP_HTTP_ORIGIN) {
    107          reject("Unknown error")
    108        } else if (event.data === "success") {
    109          resolve()
    110        } else if (event.data === "error") {
    111          reject("Error in popup")
    112        } else {
    113          return; // Ignore testharness.js internal messages
    114        }
    115        window.removeEventListener("message", messageListener)
    116        clearInterval(messagePoster)
    117        win.close()
    118      }
    119      window.addEventListener("message", messageListener)
    120    })
    121  }
    122 
    123  function local_fetch2() {
    124    return fetchFns[2].code(2)
    125  }
    126 
    127  // Final checks.
    128  function check_server_info() {
    129    return getServerState(uuid)
    130      .then(function (testState) {
    131        checkRequests(undefined, local_requests, testState)
    132        return Promise.resolve()
    133      })
    134  }
    135 
    136  promise_test(() => {
    137    return local_fetch()
    138      .then(popup_fetch)
    139      .then(local_fetch2)
    140      .then(check_server_info)
    141  }, name)
    142 }
    143 
    144 performFullTest(
    145  false /* is_cross_site_test */, false /* load_resource_in_iframe */,
    146  "HTTP cache is shared between same-site top-level frames");
    147 performFullTest(
    148  true /* is_cross_site_test */, false /* load_resource_in_iframe */,
    149  "HTTP cache is not shared between cross-site top-level frames");
    150 performFullTest(
    151  false /* is_cross_site_test */, true /* load_resource_in_iframe */,
    152  "HTTP cache is shared between same-site frames with same-site top-level frames");
    153 performFullTest(
    154  true /* is_cross_site_test */, true /* load_resource_in_iframe */,
    155  "HTTP cache is not shared between same-site frames with cross-site top-level frames");
    156 </script>
    157 </body>
    158 </html>