tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

css-images.https.sub.tentative.html (51907B)


      1 <!DOCTYPE html>
      2 <!--
      3 This test was procedurally generated. Please do not modify it directly.
      4 Sources:
      5 - fetch/metadata/tools/fetch-metadata.conf.yml
      6 - fetch/metadata/tools/templates/css-images.sub.html
      7 -->
      8 <html lang="en">
      9  <meta charset="utf-8">
     10  <meta name="timeout" content="long">
     11  <title>HTTP headers on request for CSS image-accepting properties</title>
     12  <script src="/resources/testharness.js"></script>
     13  <script src="/resources/testharnessreport.js"></script>
     14  <script src="/fetch/metadata/resources/helper.sub.js"></script>
     15  <body>
     16  <script>
     17  'use strict';
     18 
     19  /**
     20   * The subtests in this file use an iframe to induce requests for CSS
     21   * resources because an iframe's `onload` event is the most direct and
     22   * generic mechanism to detect loading of CSS resources. As an optimization,
     23   * the subtests share the same iframe and document.
     24   */
     25  const declarations = [];
     26  const iframe = document.createElement('iframe');
     27  const whenIframeReady = new Promise((resolve, reject) => {
     28    iframe.onload = resolve;
     29    iframe.onerror = reject;
     30  });
     31 
     32  async_test((t) => {
     33    const key = '{{uuid()}}';
     34    const url = makeRequestURL(key, ['httpsOrigin']);
     35 
     36    declarations.push(`background-image: url("${url}");`);
     37 
     38    whenIframeReady
     39      .then(() => retrieve(key))
     40      .then((headers) => {
     41          assert_own_property(headers, 'sec-fetch-site');
     42          assert_equals(headers['sec-fetch-site'], 'same-origin');
     43        })
     44        .then(t.step_func_done(), (error) => t.unreached_func());
     45  }, 'background-image sec-fetch-site - Same origin');
     46 
     47  async_test((t) => {
     48    const key = '{{uuid()}}';
     49    const url = makeRequestURL(key, ['httpsOrigin']);
     50 
     51    declarations.push(`border-image: url("${url}");`);
     52 
     53    whenIframeReady
     54      .then(() => retrieve(key))
     55      .then((headers) => {
     56          assert_own_property(headers, 'sec-fetch-site');
     57          assert_array_equals(headers['sec-fetch-site'], ['same-origin']);
     58        })
     59      .then(t.step_func_done(), t.unreached_func());
     60  }, 'border-image sec-fetch-site - Same origin');
     61 
     62  async_test((t) => {
     63    const key = '{{uuid()}}';
     64    const url = makeRequestURL(key, ['httpsOrigin']);
     65 
     66    declarations.push(`content: url("${url}");`);
     67 
     68    whenIframeReady
     69      .then(() => retrieve(key))
     70      .then((headers) => {
     71          assert_own_property(headers, 'sec-fetch-site');
     72          assert_array_equals(headers['sec-fetch-site'], ['same-origin']);
     73        })
     74      .then(t.step_func_done(), t.unreached_func());
     75  }, 'content sec-fetch-site - Same origin');
     76 
     77  async_test((t) => {
     78    const key = '{{uuid()}}';
     79    const url = makeRequestURL(key, ['httpsOrigin']);
     80 
     81    declarations.push(`cursor: url("${url}"), auto;`);
     82 
     83    whenIframeReady
     84      .then(() => retrieve(key))
     85      .then((headers) => {
     86          assert_own_property(headers, 'sec-fetch-site');
     87          assert_array_equals(headers['sec-fetch-site'], ['same-origin']);
     88        })
     89      .then(t.step_func_done(), t.unreached_func());
     90  }, 'cursor sec-fetch-site - Same origin');
     91 
     92  async_test((t) => {
     93    const key = '{{uuid()}}';
     94    const url = makeRequestURL(key, ['httpsOrigin']);
     95 
     96    declarations.push(`list-style-image: url("${url}");`);
     97 
     98    whenIframeReady
     99      .then(() => retrieve(key))
    100      .then((headers) => {
    101          assert_own_property(headers, 'sec-fetch-site');
    102          assert_array_equals(headers['sec-fetch-site'], ['same-origin']);
    103        })
    104      .then(t.step_func_done(), t.unreached_func());
    105  }, 'list-style-image sec-fetch-site - Same origin');
    106 
    107  async_test((t) => {
    108    const key = '{{uuid()}}';
    109    const url = makeRequestURL(key, ['httpsCrossSite']);
    110 
    111    declarations.push(`background-image: url("${url}");`);
    112 
    113    whenIframeReady
    114      .then(() => retrieve(key))
    115      .then((headers) => {
    116          assert_own_property(headers, 'sec-fetch-site');
    117          assert_equals(headers['sec-fetch-site'], 'cross-site');
    118        })
    119        .then(t.step_func_done(), (error) => t.unreached_func());
    120  }, 'background-image sec-fetch-site - Cross-site');
    121 
    122  async_test((t) => {
    123    const key = '{{uuid()}}';
    124    const url = makeRequestURL(key, ['httpsCrossSite']);
    125 
    126    declarations.push(`border-image: url("${url}");`);
    127 
    128    whenIframeReady
    129      .then(() => retrieve(key))
    130      .then((headers) => {
    131          assert_own_property(headers, 'sec-fetch-site');
    132          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    133        })
    134      .then(t.step_func_done(), t.unreached_func());
    135  }, 'border-image sec-fetch-site - Cross-site');
    136 
    137  async_test((t) => {
    138    const key = '{{uuid()}}';
    139    const url = makeRequestURL(key, ['httpsCrossSite']);
    140 
    141    declarations.push(`content: url("${url}");`);
    142 
    143    whenIframeReady
    144      .then(() => retrieve(key))
    145      .then((headers) => {
    146          assert_own_property(headers, 'sec-fetch-site');
    147          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    148        })
    149      .then(t.step_func_done(), t.unreached_func());
    150  }, 'content sec-fetch-site - Cross-site');
    151 
    152  async_test((t) => {
    153    const key = '{{uuid()}}';
    154    const url = makeRequestURL(key, ['httpsCrossSite']);
    155 
    156    declarations.push(`cursor: url("${url}"), auto;`);
    157 
    158    whenIframeReady
    159      .then(() => retrieve(key))
    160      .then((headers) => {
    161          assert_own_property(headers, 'sec-fetch-site');
    162          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    163        })
    164      .then(t.step_func_done(), t.unreached_func());
    165  }, 'cursor sec-fetch-site - Cross-site');
    166 
    167  async_test((t) => {
    168    const key = '{{uuid()}}';
    169    const url = makeRequestURL(key, ['httpsCrossSite']);
    170 
    171    declarations.push(`list-style-image: url("${url}");`);
    172 
    173    whenIframeReady
    174      .then(() => retrieve(key))
    175      .then((headers) => {
    176          assert_own_property(headers, 'sec-fetch-site');
    177          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    178        })
    179      .then(t.step_func_done(), t.unreached_func());
    180  }, 'list-style-image sec-fetch-site - Cross-site');
    181 
    182  async_test((t) => {
    183    const key = '{{uuid()}}';
    184    const url = makeRequestURL(key, ['httpsSameSite']);
    185 
    186    declarations.push(`background-image: url("${url}");`);
    187 
    188    whenIframeReady
    189      .then(() => retrieve(key))
    190      .then((headers) => {
    191          assert_own_property(headers, 'sec-fetch-site');
    192          assert_equals(headers['sec-fetch-site'], 'same-site');
    193        })
    194        .then(t.step_func_done(), (error) => t.unreached_func());
    195  }, 'background-image sec-fetch-site - Same site');
    196 
    197  async_test((t) => {
    198    const key = '{{uuid()}}';
    199    const url = makeRequestURL(key, ['httpsSameSite']);
    200 
    201    declarations.push(`border-image: url("${url}");`);
    202 
    203    whenIframeReady
    204      .then(() => retrieve(key))
    205      .then((headers) => {
    206          assert_own_property(headers, 'sec-fetch-site');
    207          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    208        })
    209      .then(t.step_func_done(), t.unreached_func());
    210  }, 'border-image sec-fetch-site - Same site');
    211 
    212  async_test((t) => {
    213    const key = '{{uuid()}}';
    214    const url = makeRequestURL(key, ['httpsSameSite']);
    215 
    216    declarations.push(`content: url("${url}");`);
    217 
    218    whenIframeReady
    219      .then(() => retrieve(key))
    220      .then((headers) => {
    221          assert_own_property(headers, 'sec-fetch-site');
    222          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    223        })
    224      .then(t.step_func_done(), t.unreached_func());
    225  }, 'content sec-fetch-site - Same site');
    226 
    227  async_test((t) => {
    228    const key = '{{uuid()}}';
    229    const url = makeRequestURL(key, ['httpsSameSite']);
    230 
    231    declarations.push(`cursor: url("${url}"), auto;`);
    232 
    233    whenIframeReady
    234      .then(() => retrieve(key))
    235      .then((headers) => {
    236          assert_own_property(headers, 'sec-fetch-site');
    237          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    238        })
    239      .then(t.step_func_done(), t.unreached_func());
    240  }, 'cursor sec-fetch-site - Same site');
    241 
    242  async_test((t) => {
    243    const key = '{{uuid()}}';
    244    const url = makeRequestURL(key, ['httpsSameSite']);
    245 
    246    declarations.push(`list-style-image: url("${url}");`);
    247 
    248    whenIframeReady
    249      .then(() => retrieve(key))
    250      .then((headers) => {
    251          assert_own_property(headers, 'sec-fetch-site');
    252          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    253        })
    254      .then(t.step_func_done(), t.unreached_func());
    255  }, 'list-style-image sec-fetch-site - Same site');
    256 
    257  async_test((t) => {
    258    const key = '{{uuid()}}';
    259    const url = makeRequestURL(key, ['httpsOrigin', 'httpsCrossSite', 'httpsOrigin']);
    260 
    261    declarations.push(`background-image: url("${url}");`);
    262 
    263    whenIframeReady
    264      .then(() => retrieve(key))
    265      .then((headers) => {
    266          assert_own_property(headers, 'sec-fetch-site');
    267          assert_equals(headers['sec-fetch-site'], 'cross-site');
    268        })
    269        .then(t.step_func_done(), (error) => t.unreached_func());
    270  }, 'background-image sec-fetch-site - Same-Origin -> Cross-Site -> Same-Origin redirect');
    271 
    272  async_test((t) => {
    273    const key = '{{uuid()}}';
    274    const url = makeRequestURL(key, ['httpsOrigin', 'httpsCrossSite', 'httpsOrigin']);
    275 
    276    declarations.push(`border-image: url("${url}");`);
    277 
    278    whenIframeReady
    279      .then(() => retrieve(key))
    280      .then((headers) => {
    281          assert_own_property(headers, 'sec-fetch-site');
    282          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    283        })
    284      .then(t.step_func_done(), t.unreached_func());
    285  }, 'border-image sec-fetch-site - Same-Origin -> Cross-Site -> Same-Origin redirect');
    286 
    287  async_test((t) => {
    288    const key = '{{uuid()}}';
    289    const url = makeRequestURL(key, ['httpsOrigin', 'httpsCrossSite', 'httpsOrigin']);
    290 
    291    declarations.push(`content: url("${url}");`);
    292 
    293    whenIframeReady
    294      .then(() => retrieve(key))
    295      .then((headers) => {
    296          assert_own_property(headers, 'sec-fetch-site');
    297          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    298        })
    299      .then(t.step_func_done(), t.unreached_func());
    300  }, 'content sec-fetch-site - Same-Origin -> Cross-Site -> Same-Origin redirect');
    301 
    302  async_test((t) => {
    303    const key = '{{uuid()}}';
    304    const url = makeRequestURL(key, ['httpsOrigin', 'httpsCrossSite', 'httpsOrigin']);
    305 
    306    declarations.push(`cursor: url("${url}"), auto;`);
    307 
    308    whenIframeReady
    309      .then(() => retrieve(key))
    310      .then((headers) => {
    311          assert_own_property(headers, 'sec-fetch-site');
    312          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    313        })
    314      .then(t.step_func_done(), t.unreached_func());
    315  }, 'cursor sec-fetch-site - Same-Origin -> Cross-Site -> Same-Origin redirect');
    316 
    317  async_test((t) => {
    318    const key = '{{uuid()}}';
    319    const url = makeRequestURL(key, ['httpsOrigin', 'httpsCrossSite', 'httpsOrigin']);
    320 
    321    declarations.push(`list-style-image: url("${url}");`);
    322 
    323    whenIframeReady
    324      .then(() => retrieve(key))
    325      .then((headers) => {
    326          assert_own_property(headers, 'sec-fetch-site');
    327          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    328        })
    329      .then(t.step_func_done(), t.unreached_func());
    330  }, 'list-style-image sec-fetch-site - Same-Origin -> Cross-Site -> Same-Origin redirect');
    331 
    332  async_test((t) => {
    333    const key = '{{uuid()}}';
    334    const url = makeRequestURL(key, ['httpsOrigin', 'httpsSameSite', 'httpsOrigin']);
    335 
    336    declarations.push(`background-image: url("${url}");`);
    337 
    338    whenIframeReady
    339      .then(() => retrieve(key))
    340      .then((headers) => {
    341          assert_own_property(headers, 'sec-fetch-site');
    342          assert_equals(headers['sec-fetch-site'], 'same-site');
    343        })
    344        .then(t.step_func_done(), (error) => t.unreached_func());
    345  }, 'background-image sec-fetch-site - Same-Origin -> Same-Site -> Same-Origin redirect');
    346 
    347  async_test((t) => {
    348    const key = '{{uuid()}}';
    349    const url = makeRequestURL(key, ['httpsOrigin', 'httpsSameSite', 'httpsOrigin']);
    350 
    351    declarations.push(`border-image: url("${url}");`);
    352 
    353    whenIframeReady
    354      .then(() => retrieve(key))
    355      .then((headers) => {
    356          assert_own_property(headers, 'sec-fetch-site');
    357          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    358        })
    359      .then(t.step_func_done(), t.unreached_func());
    360  }, 'border-image sec-fetch-site - Same-Origin -> Same-Site -> Same-Origin redirect');
    361 
    362  async_test((t) => {
    363    const key = '{{uuid()}}';
    364    const url = makeRequestURL(key, ['httpsOrigin', 'httpsSameSite', 'httpsOrigin']);
    365 
    366    declarations.push(`content: url("${url}");`);
    367 
    368    whenIframeReady
    369      .then(() => retrieve(key))
    370      .then((headers) => {
    371          assert_own_property(headers, 'sec-fetch-site');
    372          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    373        })
    374      .then(t.step_func_done(), t.unreached_func());
    375  }, 'content sec-fetch-site - Same-Origin -> Same-Site -> Same-Origin redirect');
    376 
    377  async_test((t) => {
    378    const key = '{{uuid()}}';
    379    const url = makeRequestURL(key, ['httpsOrigin', 'httpsSameSite', 'httpsOrigin']);
    380 
    381    declarations.push(`cursor: url("${url}"), auto;`);
    382 
    383    whenIframeReady
    384      .then(() => retrieve(key))
    385      .then((headers) => {
    386          assert_own_property(headers, 'sec-fetch-site');
    387          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    388        })
    389      .then(t.step_func_done(), t.unreached_func());
    390  }, 'cursor sec-fetch-site - Same-Origin -> Same-Site -> Same-Origin redirect');
    391 
    392  async_test((t) => {
    393    const key = '{{uuid()}}';
    394    const url = makeRequestURL(key, ['httpsOrigin', 'httpsSameSite', 'httpsOrigin']);
    395 
    396    declarations.push(`list-style-image: url("${url}");`);
    397 
    398    whenIframeReady
    399      .then(() => retrieve(key))
    400      .then((headers) => {
    401          assert_own_property(headers, 'sec-fetch-site');
    402          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    403        })
    404      .then(t.step_func_done(), t.unreached_func());
    405  }, 'list-style-image sec-fetch-site - Same-Origin -> Same-Site -> Same-Origin redirect');
    406 
    407  async_test((t) => {
    408    const key = '{{uuid()}}';
    409    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsOrigin']);
    410 
    411    declarations.push(`background-image: url("${url}");`);
    412 
    413    whenIframeReady
    414      .then(() => retrieve(key))
    415      .then((headers) => {
    416          assert_own_property(headers, 'sec-fetch-site');
    417          assert_equals(headers['sec-fetch-site'], 'cross-site');
    418        })
    419        .then(t.step_func_done(), (error) => t.unreached_func());
    420  }, 'background-image sec-fetch-site - Cross-Site -> Same Origin');
    421 
    422  async_test((t) => {
    423    const key = '{{uuid()}}';
    424    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsOrigin']);
    425 
    426    declarations.push(`border-image: url("${url}");`);
    427 
    428    whenIframeReady
    429      .then(() => retrieve(key))
    430      .then((headers) => {
    431          assert_own_property(headers, 'sec-fetch-site');
    432          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    433        })
    434      .then(t.step_func_done(), t.unreached_func());
    435  }, 'border-image sec-fetch-site - Cross-Site -> Same Origin');
    436 
    437  async_test((t) => {
    438    const key = '{{uuid()}}';
    439    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsOrigin']);
    440 
    441    declarations.push(`content: url("${url}");`);
    442 
    443    whenIframeReady
    444      .then(() => retrieve(key))
    445      .then((headers) => {
    446          assert_own_property(headers, 'sec-fetch-site');
    447          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    448        })
    449      .then(t.step_func_done(), t.unreached_func());
    450  }, 'content sec-fetch-site - Cross-Site -> Same Origin');
    451 
    452  async_test((t) => {
    453    const key = '{{uuid()}}';
    454    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsOrigin']);
    455 
    456    declarations.push(`cursor: url("${url}"), auto;`);
    457 
    458    whenIframeReady
    459      .then(() => retrieve(key))
    460      .then((headers) => {
    461          assert_own_property(headers, 'sec-fetch-site');
    462          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    463        })
    464      .then(t.step_func_done(), t.unreached_func());
    465  }, 'cursor sec-fetch-site - Cross-Site -> Same Origin');
    466 
    467  async_test((t) => {
    468    const key = '{{uuid()}}';
    469    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsOrigin']);
    470 
    471    declarations.push(`list-style-image: url("${url}");`);
    472 
    473    whenIframeReady
    474      .then(() => retrieve(key))
    475      .then((headers) => {
    476          assert_own_property(headers, 'sec-fetch-site');
    477          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    478        })
    479      .then(t.step_func_done(), t.unreached_func());
    480  }, 'list-style-image sec-fetch-site - Cross-Site -> Same Origin');
    481 
    482  async_test((t) => {
    483    const key = '{{uuid()}}';
    484    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsSameSite']);
    485 
    486    declarations.push(`background-image: url("${url}");`);
    487 
    488    whenIframeReady
    489      .then(() => retrieve(key))
    490      .then((headers) => {
    491          assert_own_property(headers, 'sec-fetch-site');
    492          assert_equals(headers['sec-fetch-site'], 'cross-site');
    493        })
    494        .then(t.step_func_done(), (error) => t.unreached_func());
    495  }, 'background-image sec-fetch-site - Cross-Site -> Same-Site');
    496 
    497  async_test((t) => {
    498    const key = '{{uuid()}}';
    499    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsSameSite']);
    500 
    501    declarations.push(`border-image: url("${url}");`);
    502 
    503    whenIframeReady
    504      .then(() => retrieve(key))
    505      .then((headers) => {
    506          assert_own_property(headers, 'sec-fetch-site');
    507          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    508        })
    509      .then(t.step_func_done(), t.unreached_func());
    510  }, 'border-image sec-fetch-site - Cross-Site -> Same-Site');
    511 
    512  async_test((t) => {
    513    const key = '{{uuid()}}';
    514    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsSameSite']);
    515 
    516    declarations.push(`content: url("${url}");`);
    517 
    518    whenIframeReady
    519      .then(() => retrieve(key))
    520      .then((headers) => {
    521          assert_own_property(headers, 'sec-fetch-site');
    522          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    523        })
    524      .then(t.step_func_done(), t.unreached_func());
    525  }, 'content sec-fetch-site - Cross-Site -> Same-Site');
    526 
    527  async_test((t) => {
    528    const key = '{{uuid()}}';
    529    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsSameSite']);
    530 
    531    declarations.push(`cursor: url("${url}"), auto;`);
    532 
    533    whenIframeReady
    534      .then(() => retrieve(key))
    535      .then((headers) => {
    536          assert_own_property(headers, 'sec-fetch-site');
    537          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    538        })
    539      .then(t.step_func_done(), t.unreached_func());
    540  }, 'cursor sec-fetch-site - Cross-Site -> Same-Site');
    541 
    542  async_test((t) => {
    543    const key = '{{uuid()}}';
    544    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsSameSite']);
    545 
    546    declarations.push(`list-style-image: url("${url}");`);
    547 
    548    whenIframeReady
    549      .then(() => retrieve(key))
    550      .then((headers) => {
    551          assert_own_property(headers, 'sec-fetch-site');
    552          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    553        })
    554      .then(t.step_func_done(), t.unreached_func());
    555  }, 'list-style-image sec-fetch-site - Cross-Site -> Same-Site');
    556 
    557  async_test((t) => {
    558    const key = '{{uuid()}}';
    559    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsCrossSite']);
    560 
    561    declarations.push(`background-image: url("${url}");`);
    562 
    563    whenIframeReady
    564      .then(() => retrieve(key))
    565      .then((headers) => {
    566          assert_own_property(headers, 'sec-fetch-site');
    567          assert_equals(headers['sec-fetch-site'], 'cross-site');
    568        })
    569        .then(t.step_func_done(), (error) => t.unreached_func());
    570  }, 'background-image sec-fetch-site - Cross-Site -> Cross-Site');
    571 
    572  async_test((t) => {
    573    const key = '{{uuid()}}';
    574    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsCrossSite']);
    575 
    576    declarations.push(`border-image: url("${url}");`);
    577 
    578    whenIframeReady
    579      .then(() => retrieve(key))
    580      .then((headers) => {
    581          assert_own_property(headers, 'sec-fetch-site');
    582          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    583        })
    584      .then(t.step_func_done(), t.unreached_func());
    585  }, 'border-image sec-fetch-site - Cross-Site -> Cross-Site');
    586 
    587  async_test((t) => {
    588    const key = '{{uuid()}}';
    589    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsCrossSite']);
    590 
    591    declarations.push(`content: url("${url}");`);
    592 
    593    whenIframeReady
    594      .then(() => retrieve(key))
    595      .then((headers) => {
    596          assert_own_property(headers, 'sec-fetch-site');
    597          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    598        })
    599      .then(t.step_func_done(), t.unreached_func());
    600  }, 'content sec-fetch-site - Cross-Site -> Cross-Site');
    601 
    602  async_test((t) => {
    603    const key = '{{uuid()}}';
    604    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsCrossSite']);
    605 
    606    declarations.push(`cursor: url("${url}"), auto;`);
    607 
    608    whenIframeReady
    609      .then(() => retrieve(key))
    610      .then((headers) => {
    611          assert_own_property(headers, 'sec-fetch-site');
    612          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    613        })
    614      .then(t.step_func_done(), t.unreached_func());
    615  }, 'cursor sec-fetch-site - Cross-Site -> Cross-Site');
    616 
    617  async_test((t) => {
    618    const key = '{{uuid()}}';
    619    const url = makeRequestURL(key, ['httpsCrossSite', 'httpsCrossSite']);
    620 
    621    declarations.push(`list-style-image: url("${url}");`);
    622 
    623    whenIframeReady
    624      .then(() => retrieve(key))
    625      .then((headers) => {
    626          assert_own_property(headers, 'sec-fetch-site');
    627          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    628        })
    629      .then(t.step_func_done(), t.unreached_func());
    630  }, 'list-style-image sec-fetch-site - Cross-Site -> Cross-Site');
    631 
    632  async_test((t) => {
    633    const key = '{{uuid()}}';
    634    const url = makeRequestURL(key, ['httpsOrigin', 'httpsOrigin']);
    635 
    636    declarations.push(`background-image: url("${url}");`);
    637 
    638    whenIframeReady
    639      .then(() => retrieve(key))
    640      .then((headers) => {
    641          assert_own_property(headers, 'sec-fetch-site');
    642          assert_equals(headers['sec-fetch-site'], 'same-origin');
    643        })
    644        .then(t.step_func_done(), (error) => t.unreached_func());
    645  }, 'background-image sec-fetch-site - Same-Origin -> Same Origin');
    646 
    647  async_test((t) => {
    648    const key = '{{uuid()}}';
    649    const url = makeRequestURL(key, ['httpsOrigin', 'httpsOrigin']);
    650 
    651    declarations.push(`border-image: url("${url}");`);
    652 
    653    whenIframeReady
    654      .then(() => retrieve(key))
    655      .then((headers) => {
    656          assert_own_property(headers, 'sec-fetch-site');
    657          assert_array_equals(headers['sec-fetch-site'], ['same-origin']);
    658        })
    659      .then(t.step_func_done(), t.unreached_func());
    660  }, 'border-image sec-fetch-site - Same-Origin -> Same Origin');
    661 
    662  async_test((t) => {
    663    const key = '{{uuid()}}';
    664    const url = makeRequestURL(key, ['httpsOrigin', 'httpsOrigin']);
    665 
    666    declarations.push(`content: url("${url}");`);
    667 
    668    whenIframeReady
    669      .then(() => retrieve(key))
    670      .then((headers) => {
    671          assert_own_property(headers, 'sec-fetch-site');
    672          assert_array_equals(headers['sec-fetch-site'], ['same-origin']);
    673        })
    674      .then(t.step_func_done(), t.unreached_func());
    675  }, 'content sec-fetch-site - Same-Origin -> Same Origin');
    676 
    677  async_test((t) => {
    678    const key = '{{uuid()}}';
    679    const url = makeRequestURL(key, ['httpsOrigin', 'httpsOrigin']);
    680 
    681    declarations.push(`cursor: url("${url}"), auto;`);
    682 
    683    whenIframeReady
    684      .then(() => retrieve(key))
    685      .then((headers) => {
    686          assert_own_property(headers, 'sec-fetch-site');
    687          assert_array_equals(headers['sec-fetch-site'], ['same-origin']);
    688        })
    689      .then(t.step_func_done(), t.unreached_func());
    690  }, 'cursor sec-fetch-site - Same-Origin -> Same Origin');
    691 
    692  async_test((t) => {
    693    const key = '{{uuid()}}';
    694    const url = makeRequestURL(key, ['httpsOrigin', 'httpsOrigin']);
    695 
    696    declarations.push(`list-style-image: url("${url}");`);
    697 
    698    whenIframeReady
    699      .then(() => retrieve(key))
    700      .then((headers) => {
    701          assert_own_property(headers, 'sec-fetch-site');
    702          assert_array_equals(headers['sec-fetch-site'], ['same-origin']);
    703        })
    704      .then(t.step_func_done(), t.unreached_func());
    705  }, 'list-style-image sec-fetch-site - Same-Origin -> Same Origin');
    706 
    707  async_test((t) => {
    708    const key = '{{uuid()}}';
    709    const url = makeRequestURL(key, ['httpsOrigin', 'httpsSameSite']);
    710 
    711    declarations.push(`background-image: url("${url}");`);
    712 
    713    whenIframeReady
    714      .then(() => retrieve(key))
    715      .then((headers) => {
    716          assert_own_property(headers, 'sec-fetch-site');
    717          assert_equals(headers['sec-fetch-site'], 'same-site');
    718        })
    719        .then(t.step_func_done(), (error) => t.unreached_func());
    720  }, 'background-image sec-fetch-site - Same-Origin -> Same-Site');
    721 
    722  async_test((t) => {
    723    const key = '{{uuid()}}';
    724    const url = makeRequestURL(key, ['httpsOrigin', 'httpsSameSite']);
    725 
    726    declarations.push(`border-image: url("${url}");`);
    727 
    728    whenIframeReady
    729      .then(() => retrieve(key))
    730      .then((headers) => {
    731          assert_own_property(headers, 'sec-fetch-site');
    732          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    733        })
    734      .then(t.step_func_done(), t.unreached_func());
    735  }, 'border-image sec-fetch-site - Same-Origin -> Same-Site');
    736 
    737  async_test((t) => {
    738    const key = '{{uuid()}}';
    739    const url = makeRequestURL(key, ['httpsOrigin', 'httpsSameSite']);
    740 
    741    declarations.push(`content: url("${url}");`);
    742 
    743    whenIframeReady
    744      .then(() => retrieve(key))
    745      .then((headers) => {
    746          assert_own_property(headers, 'sec-fetch-site');
    747          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    748        })
    749      .then(t.step_func_done(), t.unreached_func());
    750  }, 'content sec-fetch-site - Same-Origin -> Same-Site');
    751 
    752  async_test((t) => {
    753    const key = '{{uuid()}}';
    754    const url = makeRequestURL(key, ['httpsOrigin', 'httpsSameSite']);
    755 
    756    declarations.push(`cursor: url("${url}"), auto;`);
    757 
    758    whenIframeReady
    759      .then(() => retrieve(key))
    760      .then((headers) => {
    761          assert_own_property(headers, 'sec-fetch-site');
    762          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    763        })
    764      .then(t.step_func_done(), t.unreached_func());
    765  }, 'cursor sec-fetch-site - Same-Origin -> Same-Site');
    766 
    767  async_test((t) => {
    768    const key = '{{uuid()}}';
    769    const url = makeRequestURL(key, ['httpsOrigin', 'httpsSameSite']);
    770 
    771    declarations.push(`list-style-image: url("${url}");`);
    772 
    773    whenIframeReady
    774      .then(() => retrieve(key))
    775      .then((headers) => {
    776          assert_own_property(headers, 'sec-fetch-site');
    777          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    778        })
    779      .then(t.step_func_done(), t.unreached_func());
    780  }, 'list-style-image sec-fetch-site - Same-Origin -> Same-Site');
    781 
    782  async_test((t) => {
    783    const key = '{{uuid()}}';
    784    const url = makeRequestURL(key, ['httpsOrigin', 'httpsCrossSite']);
    785 
    786    declarations.push(`background-image: url("${url}");`);
    787 
    788    whenIframeReady
    789      .then(() => retrieve(key))
    790      .then((headers) => {
    791          assert_own_property(headers, 'sec-fetch-site');
    792          assert_equals(headers['sec-fetch-site'], 'cross-site');
    793        })
    794        .then(t.step_func_done(), (error) => t.unreached_func());
    795  }, 'background-image sec-fetch-site - Same-Origin -> Cross-Site');
    796 
    797  async_test((t) => {
    798    const key = '{{uuid()}}';
    799    const url = makeRequestURL(key, ['httpsOrigin', 'httpsCrossSite']);
    800 
    801    declarations.push(`border-image: url("${url}");`);
    802 
    803    whenIframeReady
    804      .then(() => retrieve(key))
    805      .then((headers) => {
    806          assert_own_property(headers, 'sec-fetch-site');
    807          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    808        })
    809      .then(t.step_func_done(), t.unreached_func());
    810  }, 'border-image sec-fetch-site - Same-Origin -> Cross-Site');
    811 
    812  async_test((t) => {
    813    const key = '{{uuid()}}';
    814    const url = makeRequestURL(key, ['httpsOrigin', 'httpsCrossSite']);
    815 
    816    declarations.push(`content: url("${url}");`);
    817 
    818    whenIframeReady
    819      .then(() => retrieve(key))
    820      .then((headers) => {
    821          assert_own_property(headers, 'sec-fetch-site');
    822          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    823        })
    824      .then(t.step_func_done(), t.unreached_func());
    825  }, 'content sec-fetch-site - Same-Origin -> Cross-Site');
    826 
    827  async_test((t) => {
    828    const key = '{{uuid()}}';
    829    const url = makeRequestURL(key, ['httpsOrigin', 'httpsCrossSite']);
    830 
    831    declarations.push(`cursor: url("${url}"), auto;`);
    832 
    833    whenIframeReady
    834      .then(() => retrieve(key))
    835      .then((headers) => {
    836          assert_own_property(headers, 'sec-fetch-site');
    837          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    838        })
    839      .then(t.step_func_done(), t.unreached_func());
    840  }, 'cursor sec-fetch-site - Same-Origin -> Cross-Site');
    841 
    842  async_test((t) => {
    843    const key = '{{uuid()}}';
    844    const url = makeRequestURL(key, ['httpsOrigin', 'httpsCrossSite']);
    845 
    846    declarations.push(`list-style-image: url("${url}");`);
    847 
    848    whenIframeReady
    849      .then(() => retrieve(key))
    850      .then((headers) => {
    851          assert_own_property(headers, 'sec-fetch-site');
    852          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
    853        })
    854      .then(t.step_func_done(), t.unreached_func());
    855  }, 'list-style-image sec-fetch-site - Same-Origin -> Cross-Site');
    856 
    857  async_test((t) => {
    858    const key = '{{uuid()}}';
    859    const url = makeRequestURL(key, ['httpsSameSite', 'httpsOrigin']);
    860 
    861    declarations.push(`background-image: url("${url}");`);
    862 
    863    whenIframeReady
    864      .then(() => retrieve(key))
    865      .then((headers) => {
    866          assert_own_property(headers, 'sec-fetch-site');
    867          assert_equals(headers['sec-fetch-site'], 'same-site');
    868        })
    869        .then(t.step_func_done(), (error) => t.unreached_func());
    870  }, 'background-image sec-fetch-site - Same-Site -> Same Origin');
    871 
    872  async_test((t) => {
    873    const key = '{{uuid()}}';
    874    const url = makeRequestURL(key, ['httpsSameSite', 'httpsOrigin']);
    875 
    876    declarations.push(`border-image: url("${url}");`);
    877 
    878    whenIframeReady
    879      .then(() => retrieve(key))
    880      .then((headers) => {
    881          assert_own_property(headers, 'sec-fetch-site');
    882          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    883        })
    884      .then(t.step_func_done(), t.unreached_func());
    885  }, 'border-image sec-fetch-site - Same-Site -> Same Origin');
    886 
    887  async_test((t) => {
    888    const key = '{{uuid()}}';
    889    const url = makeRequestURL(key, ['httpsSameSite', 'httpsOrigin']);
    890 
    891    declarations.push(`content: url("${url}");`);
    892 
    893    whenIframeReady
    894      .then(() => retrieve(key))
    895      .then((headers) => {
    896          assert_own_property(headers, 'sec-fetch-site');
    897          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    898        })
    899      .then(t.step_func_done(), t.unreached_func());
    900  }, 'content sec-fetch-site - Same-Site -> Same Origin');
    901 
    902  async_test((t) => {
    903    const key = '{{uuid()}}';
    904    const url = makeRequestURL(key, ['httpsSameSite', 'httpsOrigin']);
    905 
    906    declarations.push(`cursor: url("${url}"), auto;`);
    907 
    908    whenIframeReady
    909      .then(() => retrieve(key))
    910      .then((headers) => {
    911          assert_own_property(headers, 'sec-fetch-site');
    912          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    913        })
    914      .then(t.step_func_done(), t.unreached_func());
    915  }, 'cursor sec-fetch-site - Same-Site -> Same Origin');
    916 
    917  async_test((t) => {
    918    const key = '{{uuid()}}';
    919    const url = makeRequestURL(key, ['httpsSameSite', 'httpsOrigin']);
    920 
    921    declarations.push(`list-style-image: url("${url}");`);
    922 
    923    whenIframeReady
    924      .then(() => retrieve(key))
    925      .then((headers) => {
    926          assert_own_property(headers, 'sec-fetch-site');
    927          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    928        })
    929      .then(t.step_func_done(), t.unreached_func());
    930  }, 'list-style-image sec-fetch-site - Same-Site -> Same Origin');
    931 
    932  async_test((t) => {
    933    const key = '{{uuid()}}';
    934    const url = makeRequestURL(key, ['httpsSameSite', 'httpsSameSite']);
    935 
    936    declarations.push(`background-image: url("${url}");`);
    937 
    938    whenIframeReady
    939      .then(() => retrieve(key))
    940      .then((headers) => {
    941          assert_own_property(headers, 'sec-fetch-site');
    942          assert_equals(headers['sec-fetch-site'], 'same-site');
    943        })
    944        .then(t.step_func_done(), (error) => t.unreached_func());
    945  }, 'background-image sec-fetch-site - Same-Site -> Same-Site');
    946 
    947  async_test((t) => {
    948    const key = '{{uuid()}}';
    949    const url = makeRequestURL(key, ['httpsSameSite', 'httpsSameSite']);
    950 
    951    declarations.push(`border-image: url("${url}");`);
    952 
    953    whenIframeReady
    954      .then(() => retrieve(key))
    955      .then((headers) => {
    956          assert_own_property(headers, 'sec-fetch-site');
    957          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    958        })
    959      .then(t.step_func_done(), t.unreached_func());
    960  }, 'border-image sec-fetch-site - Same-Site -> Same-Site');
    961 
    962  async_test((t) => {
    963    const key = '{{uuid()}}';
    964    const url = makeRequestURL(key, ['httpsSameSite', 'httpsSameSite']);
    965 
    966    declarations.push(`content: url("${url}");`);
    967 
    968    whenIframeReady
    969      .then(() => retrieve(key))
    970      .then((headers) => {
    971          assert_own_property(headers, 'sec-fetch-site');
    972          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    973        })
    974      .then(t.step_func_done(), t.unreached_func());
    975  }, 'content sec-fetch-site - Same-Site -> Same-Site');
    976 
    977  async_test((t) => {
    978    const key = '{{uuid()}}';
    979    const url = makeRequestURL(key, ['httpsSameSite', 'httpsSameSite']);
    980 
    981    declarations.push(`cursor: url("${url}"), auto;`);
    982 
    983    whenIframeReady
    984      .then(() => retrieve(key))
    985      .then((headers) => {
    986          assert_own_property(headers, 'sec-fetch-site');
    987          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
    988        })
    989      .then(t.step_func_done(), t.unreached_func());
    990  }, 'cursor sec-fetch-site - Same-Site -> Same-Site');
    991 
    992  async_test((t) => {
    993    const key = '{{uuid()}}';
    994    const url = makeRequestURL(key, ['httpsSameSite', 'httpsSameSite']);
    995 
    996    declarations.push(`list-style-image: url("${url}");`);
    997 
    998    whenIframeReady
    999      .then(() => retrieve(key))
   1000      .then((headers) => {
   1001          assert_own_property(headers, 'sec-fetch-site');
   1002          assert_array_equals(headers['sec-fetch-site'], ['same-site']);
   1003        })
   1004      .then(t.step_func_done(), t.unreached_func());
   1005  }, 'list-style-image sec-fetch-site - Same-Site -> Same-Site');
   1006 
   1007  async_test((t) => {
   1008    const key = '{{uuid()}}';
   1009    const url = makeRequestURL(key, ['httpsSameSite', 'httpsCrossSite']);
   1010 
   1011    declarations.push(`background-image: url("${url}");`);
   1012 
   1013    whenIframeReady
   1014      .then(() => retrieve(key))
   1015      .then((headers) => {
   1016          assert_own_property(headers, 'sec-fetch-site');
   1017          assert_equals(headers['sec-fetch-site'], 'cross-site');
   1018        })
   1019        .then(t.step_func_done(), (error) => t.unreached_func());
   1020  }, 'background-image sec-fetch-site - Same-Site -> Cross-Site');
   1021 
   1022  async_test((t) => {
   1023    const key = '{{uuid()}}';
   1024    const url = makeRequestURL(key, ['httpsSameSite', 'httpsCrossSite']);
   1025 
   1026    declarations.push(`border-image: url("${url}");`);
   1027 
   1028    whenIframeReady
   1029      .then(() => retrieve(key))
   1030      .then((headers) => {
   1031          assert_own_property(headers, 'sec-fetch-site');
   1032          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
   1033        })
   1034      .then(t.step_func_done(), t.unreached_func());
   1035  }, 'border-image sec-fetch-site - Same-Site -> Cross-Site');
   1036 
   1037  async_test((t) => {
   1038    const key = '{{uuid()}}';
   1039    const url = makeRequestURL(key, ['httpsSameSite', 'httpsCrossSite']);
   1040 
   1041    declarations.push(`content: url("${url}");`);
   1042 
   1043    whenIframeReady
   1044      .then(() => retrieve(key))
   1045      .then((headers) => {
   1046          assert_own_property(headers, 'sec-fetch-site');
   1047          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
   1048        })
   1049      .then(t.step_func_done(), t.unreached_func());
   1050  }, 'content sec-fetch-site - Same-Site -> Cross-Site');
   1051 
   1052  async_test((t) => {
   1053    const key = '{{uuid()}}';
   1054    const url = makeRequestURL(key, ['httpsSameSite', 'httpsCrossSite']);
   1055 
   1056    declarations.push(`cursor: url("${url}"), auto;`);
   1057 
   1058    whenIframeReady
   1059      .then(() => retrieve(key))
   1060      .then((headers) => {
   1061          assert_own_property(headers, 'sec-fetch-site');
   1062          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
   1063        })
   1064      .then(t.step_func_done(), t.unreached_func());
   1065  }, 'cursor sec-fetch-site - Same-Site -> Cross-Site');
   1066 
   1067  async_test((t) => {
   1068    const key = '{{uuid()}}';
   1069    const url = makeRequestURL(key, ['httpsSameSite', 'httpsCrossSite']);
   1070 
   1071    declarations.push(`list-style-image: url("${url}");`);
   1072 
   1073    whenIframeReady
   1074      .then(() => retrieve(key))
   1075      .then((headers) => {
   1076          assert_own_property(headers, 'sec-fetch-site');
   1077          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
   1078        })
   1079      .then(t.step_func_done(), t.unreached_func());
   1080  }, 'list-style-image sec-fetch-site - Same-Site -> Cross-Site');
   1081 
   1082  async_test((t) => {
   1083    const key = '{{uuid()}}';
   1084    const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin', 'httpsOrigin']);
   1085 
   1086    declarations.push(`background-image: url("${url}");`);
   1087 
   1088    whenIframeReady
   1089      .then(() => retrieve(key))
   1090      .then((headers) => {
   1091          assert_own_property(headers, 'sec-fetch-site');
   1092          assert_equals(headers['sec-fetch-site'], 'cross-site');
   1093        })
   1094        .then(t.step_func_done(), (error) => t.unreached_func());
   1095  }, 'background-image sec-fetch-site - HTTPS downgrade-upgrade');
   1096 
   1097  async_test((t) => {
   1098    const key = '{{uuid()}}';
   1099    const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin', 'httpsOrigin']);
   1100 
   1101    declarations.push(`border-image: url("${url}");`);
   1102 
   1103    whenIframeReady
   1104      .then(() => retrieve(key))
   1105      .then((headers) => {
   1106          assert_own_property(headers, 'sec-fetch-site');
   1107          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
   1108        })
   1109      .then(t.step_func_done(), t.unreached_func());
   1110  }, 'border-image sec-fetch-site - HTTPS downgrade-upgrade');
   1111 
   1112  async_test((t) => {
   1113    const key = '{{uuid()}}';
   1114    const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin', 'httpsOrigin']);
   1115 
   1116    declarations.push(`content: url("${url}");`);
   1117 
   1118    whenIframeReady
   1119      .then(() => retrieve(key))
   1120      .then((headers) => {
   1121          assert_own_property(headers, 'sec-fetch-site');
   1122          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
   1123        })
   1124      .then(t.step_func_done(), t.unreached_func());
   1125  }, 'content sec-fetch-site - HTTPS downgrade-upgrade');
   1126 
   1127  async_test((t) => {
   1128    const key = '{{uuid()}}';
   1129    const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin', 'httpsOrigin']);
   1130 
   1131    declarations.push(`cursor: url("${url}"), auto;`);
   1132 
   1133    whenIframeReady
   1134      .then(() => retrieve(key))
   1135      .then((headers) => {
   1136          assert_own_property(headers, 'sec-fetch-site');
   1137          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
   1138        })
   1139      .then(t.step_func_done(), t.unreached_func());
   1140  }, 'cursor sec-fetch-site - HTTPS downgrade-upgrade');
   1141 
   1142  async_test((t) => {
   1143    const key = '{{uuid()}}';
   1144    const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin', 'httpsOrigin']);
   1145 
   1146    declarations.push(`list-style-image: url("${url}");`);
   1147 
   1148    whenIframeReady
   1149      .then(() => retrieve(key))
   1150      .then((headers) => {
   1151          assert_own_property(headers, 'sec-fetch-site');
   1152          assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
   1153        })
   1154      .then(t.step_func_done(), t.unreached_func());
   1155  }, 'list-style-image sec-fetch-site - HTTPS downgrade-upgrade');
   1156 
   1157  async_test((t) => {
   1158    const key = '{{uuid()}}';
   1159    const url = makeRequestURL(key, []);
   1160 
   1161    declarations.push(`background-image: url("${url}");`);
   1162 
   1163    whenIframeReady
   1164      .then(() => retrieve(key))
   1165      .then((headers) => {
   1166          assert_own_property(headers, 'sec-fetch-mode');
   1167          assert_equals(headers['sec-fetch-mode'], 'no-cors');
   1168        })
   1169        .then(t.step_func_done(), (error) => t.unreached_func());
   1170  }, 'background-image sec-fetch-mode');
   1171 
   1172  async_test((t) => {
   1173    const key = '{{uuid()}}';
   1174    const url = makeRequestURL(key, []);
   1175 
   1176    declarations.push(`border-image: url("${url}");`);
   1177 
   1178    whenIframeReady
   1179      .then(() => retrieve(key))
   1180      .then((headers) => {
   1181          assert_own_property(headers, 'sec-fetch-mode');
   1182          assert_array_equals(headers['sec-fetch-mode'], ['no-cors']);
   1183        })
   1184      .then(t.step_func_done(), t.unreached_func());
   1185  }, 'border-image sec-fetch-mode');
   1186 
   1187  async_test((t) => {
   1188    const key = '{{uuid()}}';
   1189    const url = makeRequestURL(key, []);
   1190 
   1191    declarations.push(`content: url("${url}");`);
   1192 
   1193    whenIframeReady
   1194      .then(() => retrieve(key))
   1195      .then((headers) => {
   1196          assert_own_property(headers, 'sec-fetch-mode');
   1197          assert_array_equals(headers['sec-fetch-mode'], ['no-cors']);
   1198        })
   1199      .then(t.step_func_done(), t.unreached_func());
   1200  }, 'content sec-fetch-mode');
   1201 
   1202  async_test((t) => {
   1203    const key = '{{uuid()}}';
   1204    const url = makeRequestURL(key, []);
   1205 
   1206    declarations.push(`cursor: url("${url}"), auto;`);
   1207 
   1208    whenIframeReady
   1209      .then(() => retrieve(key))
   1210      .then((headers) => {
   1211          assert_own_property(headers, 'sec-fetch-mode');
   1212          assert_array_equals(headers['sec-fetch-mode'], ['no-cors']);
   1213        })
   1214      .then(t.step_func_done(), t.unreached_func());
   1215  }, 'cursor sec-fetch-mode');
   1216 
   1217  async_test((t) => {
   1218    const key = '{{uuid()}}';
   1219    const url = makeRequestURL(key, []);
   1220 
   1221    declarations.push(`list-style-image: url("${url}");`);
   1222 
   1223    whenIframeReady
   1224      .then(() => retrieve(key))
   1225      .then((headers) => {
   1226          assert_own_property(headers, 'sec-fetch-mode');
   1227          assert_array_equals(headers['sec-fetch-mode'], ['no-cors']);
   1228        })
   1229      .then(t.step_func_done(), t.unreached_func());
   1230  }, 'list-style-image sec-fetch-mode');
   1231 
   1232  async_test((t) => {
   1233    const key = '{{uuid()}}';
   1234    const url = makeRequestURL(key, []);
   1235 
   1236    declarations.push(`background-image: url("${url}");`);
   1237 
   1238    whenIframeReady
   1239      .then(() => retrieve(key))
   1240      .then((headers) => {
   1241          assert_own_property(headers, 'sec-fetch-dest');
   1242          assert_equals(headers['sec-fetch-dest'], 'image');
   1243        })
   1244        .then(t.step_func_done(), (error) => t.unreached_func());
   1245  }, 'background-image sec-fetch-dest');
   1246 
   1247  async_test((t) => {
   1248    const key = '{{uuid()}}';
   1249    const url = makeRequestURL(key, []);
   1250 
   1251    declarations.push(`border-image: url("${url}");`);
   1252 
   1253    whenIframeReady
   1254      .then(() => retrieve(key))
   1255      .then((headers) => {
   1256          assert_own_property(headers, 'sec-fetch-dest');
   1257          assert_array_equals(headers['sec-fetch-dest'], ['image']);
   1258        })
   1259      .then(t.step_func_done(), t.unreached_func());
   1260  }, 'border-image sec-fetch-dest');
   1261 
   1262  async_test((t) => {
   1263    const key = '{{uuid()}}';
   1264    const url = makeRequestURL(key, []);
   1265 
   1266    declarations.push(`content: url("${url}");`);
   1267 
   1268    whenIframeReady
   1269      .then(() => retrieve(key))
   1270      .then((headers) => {
   1271          assert_own_property(headers, 'sec-fetch-dest');
   1272          assert_array_equals(headers['sec-fetch-dest'], ['image']);
   1273        })
   1274      .then(t.step_func_done(), t.unreached_func());
   1275  }, 'content sec-fetch-dest');
   1276 
   1277  async_test((t) => {
   1278    const key = '{{uuid()}}';
   1279    const url = makeRequestURL(key, []);
   1280 
   1281    declarations.push(`cursor: url("${url}"), auto;`);
   1282 
   1283    whenIframeReady
   1284      .then(() => retrieve(key))
   1285      .then((headers) => {
   1286          assert_own_property(headers, 'sec-fetch-dest');
   1287          assert_array_equals(headers['sec-fetch-dest'], ['image']);
   1288        })
   1289      .then(t.step_func_done(), t.unreached_func());
   1290  }, 'cursor sec-fetch-dest');
   1291 
   1292  async_test((t) => {
   1293    const key = '{{uuid()}}';
   1294    const url = makeRequestURL(key, []);
   1295 
   1296    declarations.push(`list-style-image: url("${url}");`);
   1297 
   1298    whenIframeReady
   1299      .then(() => retrieve(key))
   1300      .then((headers) => {
   1301          assert_own_property(headers, 'sec-fetch-dest');
   1302          assert_array_equals(headers['sec-fetch-dest'], ['image']);
   1303        })
   1304      .then(t.step_func_done(), t.unreached_func());
   1305  }, 'list-style-image sec-fetch-dest');
   1306 
   1307  async_test((t) => {
   1308    const key = '{{uuid()}}';
   1309    const url = makeRequestURL(key, []);
   1310 
   1311    declarations.push(`background-image: url("${url}");`);
   1312 
   1313    whenIframeReady
   1314      .then(() => retrieve(key))
   1315      .then((headers) => {
   1316          assert_not_own_property(headers, 'sec-fetch-user');
   1317        })
   1318        .then(t.step_func_done(), (error) => t.unreached_func());
   1319  }, 'background-image sec-fetch-user');
   1320 
   1321  async_test((t) => {
   1322    const key = '{{uuid()}}';
   1323    const url = makeRequestURL(key, []);
   1324 
   1325    declarations.push(`border-image: url("${url}");`);
   1326 
   1327    whenIframeReady
   1328      .then(() => retrieve(key))
   1329      .then((headers) => {
   1330          assert_not_own_property(headers, 'sec-fetch-user');
   1331        })
   1332      .then(t.step_func_done(), t.unreached_func());
   1333  }, 'border-image sec-fetch-user');
   1334 
   1335  async_test((t) => {
   1336    const key = '{{uuid()}}';
   1337    const url = makeRequestURL(key, []);
   1338 
   1339    declarations.push(`content: url("${url}");`);
   1340 
   1341    whenIframeReady
   1342      .then(() => retrieve(key))
   1343      .then((headers) => {
   1344          assert_not_own_property(headers, 'sec-fetch-user');
   1345        })
   1346      .then(t.step_func_done(), t.unreached_func());
   1347  }, 'content sec-fetch-user');
   1348 
   1349  async_test((t) => {
   1350    const key = '{{uuid()}}';
   1351    const url = makeRequestURL(key, []);
   1352 
   1353    declarations.push(`cursor: url("${url}"), auto;`);
   1354 
   1355    whenIframeReady
   1356      .then(() => retrieve(key))
   1357      .then((headers) => {
   1358          assert_not_own_property(headers, 'sec-fetch-user');
   1359        })
   1360      .then(t.step_func_done(), t.unreached_func());
   1361  }, 'cursor sec-fetch-user');
   1362 
   1363  async_test((t) => {
   1364    const key = '{{uuid()}}';
   1365    const url = makeRequestURL(key, []);
   1366 
   1367    declarations.push(`list-style-image: url("${url}");`);
   1368 
   1369    whenIframeReady
   1370      .then(() => retrieve(key))
   1371      .then((headers) => {
   1372          assert_not_own_property(headers, 'sec-fetch-user');
   1373        })
   1374      .then(t.step_func_done(), t.unreached_func());
   1375  }, 'list-style-image sec-fetch-user');
   1376 
   1377  async_test((t) => {
   1378    const key = '{{uuid()}}';
   1379    const url = makeRequestURL(key, ['httpsCrossSite']);
   1380 
   1381    declarations.push(`background-image: url("${url}");`);
   1382 
   1383    whenIframeReady
   1384      .then(() => retrieve(key))
   1385      .then((headers) => {
   1386          assert_own_property(headers, 'sec-fetch-storage-access');
   1387          assert_equals(headers['sec-fetch-storage-access'], 'none');
   1388        })
   1389        .then(t.step_func_done(), (error) => t.unreached_func());
   1390  }, 'background-image sec-fetch-storage-access - Cross-site');
   1391 
   1392  async_test((t) => {
   1393    const key = '{{uuid()}}';
   1394    const url = makeRequestURL(key, ['httpsCrossSite']);
   1395 
   1396    declarations.push(`border-image: url("${url}");`);
   1397 
   1398    whenIframeReady
   1399      .then(() => retrieve(key))
   1400      .then((headers) => {
   1401          assert_own_property(headers, 'sec-fetch-storage-access');
   1402          assert_array_equals(headers['sec-fetch-storage-access'], ['none']);
   1403        })
   1404      .then(t.step_func_done(), t.unreached_func());
   1405  }, 'border-image sec-fetch-storage-access - Cross-site');
   1406 
   1407  async_test((t) => {
   1408    const key = '{{uuid()}}';
   1409    const url = makeRequestURL(key, ['httpsCrossSite']);
   1410 
   1411    declarations.push(`content: url("${url}");`);
   1412 
   1413    whenIframeReady
   1414      .then(() => retrieve(key))
   1415      .then((headers) => {
   1416          assert_own_property(headers, 'sec-fetch-storage-access');
   1417          assert_array_equals(headers['sec-fetch-storage-access'], ['none']);
   1418        })
   1419      .then(t.step_func_done(), t.unreached_func());
   1420  }, 'content sec-fetch-storage-access - Cross-site');
   1421 
   1422  async_test((t) => {
   1423    const key = '{{uuid()}}';
   1424    const url = makeRequestURL(key, ['httpsCrossSite']);
   1425 
   1426    declarations.push(`cursor: url("${url}"), auto;`);
   1427 
   1428    whenIframeReady
   1429      .then(() => retrieve(key))
   1430      .then((headers) => {
   1431          assert_own_property(headers, 'sec-fetch-storage-access');
   1432          assert_array_equals(headers['sec-fetch-storage-access'], ['none']);
   1433        })
   1434      .then(t.step_func_done(), t.unreached_func());
   1435  }, 'cursor sec-fetch-storage-access - Cross-site');
   1436 
   1437  async_test((t) => {
   1438    const key = '{{uuid()}}';
   1439    const url = makeRequestURL(key, ['httpsCrossSite']);
   1440 
   1441    declarations.push(`list-style-image: url("${url}");`);
   1442 
   1443    whenIframeReady
   1444      .then(() => retrieve(key))
   1445      .then((headers) => {
   1446          assert_own_property(headers, 'sec-fetch-storage-access');
   1447          assert_array_equals(headers['sec-fetch-storage-access'], ['none']);
   1448        })
   1449      .then(t.step_func_done(), t.unreached_func());
   1450  }, 'list-style-image sec-fetch-storage-access - Cross-site');
   1451 
   1452  async_test((t) => {
   1453    const key = '{{uuid()}}';
   1454    const url = makeRequestURL(key, ['httpsSameSite']);
   1455 
   1456    declarations.push(`background-image: url("${url}");`);
   1457 
   1458    whenIframeReady
   1459      .then(() => retrieve(key))
   1460      .then((headers) => {
   1461          assert_not_own_property(headers, 'sec-fetch-storage-access');
   1462        })
   1463        .then(t.step_func_done(), (error) => t.unreached_func());
   1464  }, 'background-image sec-fetch-storage-access - Same site');
   1465 
   1466  async_test((t) => {
   1467    const key = '{{uuid()}}';
   1468    const url = makeRequestURL(key, ['httpsSameSite']);
   1469 
   1470    declarations.push(`border-image: url("${url}");`);
   1471 
   1472    whenIframeReady
   1473      .then(() => retrieve(key))
   1474      .then((headers) => {
   1475          assert_not_own_property(headers, 'sec-fetch-storage-access');
   1476        })
   1477      .then(t.step_func_done(), t.unreached_func());
   1478  }, 'border-image sec-fetch-storage-access - Same site');
   1479 
   1480  async_test((t) => {
   1481    const key = '{{uuid()}}';
   1482    const url = makeRequestURL(key, ['httpsSameSite']);
   1483 
   1484    declarations.push(`content: url("${url}");`);
   1485 
   1486    whenIframeReady
   1487      .then(() => retrieve(key))
   1488      .then((headers) => {
   1489          assert_not_own_property(headers, 'sec-fetch-storage-access');
   1490        })
   1491      .then(t.step_func_done(), t.unreached_func());
   1492  }, 'content sec-fetch-storage-access - Same site');
   1493 
   1494  async_test((t) => {
   1495    const key = '{{uuid()}}';
   1496    const url = makeRequestURL(key, ['httpsSameSite']);
   1497 
   1498    declarations.push(`cursor: url("${url}"), auto;`);
   1499 
   1500    whenIframeReady
   1501      .then(() => retrieve(key))
   1502      .then((headers) => {
   1503          assert_not_own_property(headers, 'sec-fetch-storage-access');
   1504        })
   1505      .then(t.step_func_done(), t.unreached_func());
   1506  }, 'cursor sec-fetch-storage-access - Same site');
   1507 
   1508  async_test((t) => {
   1509    const key = '{{uuid()}}';
   1510    const url = makeRequestURL(key, ['httpsSameSite']);
   1511 
   1512    declarations.push(`list-style-image: url("${url}");`);
   1513 
   1514    whenIframeReady
   1515      .then(() => retrieve(key))
   1516      .then((headers) => {
   1517          assert_not_own_property(headers, 'sec-fetch-storage-access');
   1518        })
   1519      .then(t.step_func_done(), t.unreached_func());
   1520  }, 'list-style-image sec-fetch-storage-access - Same site');
   1521 
   1522  iframe.srcdoc = declarations.map((declaration, index) => `
   1523    <style>.el${index} { ${declaration} }</style><div class="el${index}"></div>`
   1524    ).join('');
   1525  document.body.appendChild(iframe);
   1526 
   1527  </script>
   1528  </body>
   1529 </html>