modulepreload-inline-referrerpolicy.html (3927B)
1 <!DOCTYPE html> 2 <html> 3 <head> 4 <title>Modulepreload Inline Referrer Policy Tests</title> 5 <meta name="author" title="Google" href="https://www.google.com/"> 6 <link rel="help" href="https://html.spec.whatwg.org/multipage/links.html#link-type-modulepreload"> 7 <link rel="help" href="https://w3c.github.io/webappsec-referrer-policy/"> 8 <meta name="assert" content="link rel=modulepreload respects the referrerpolicy attribute on inline elements"> 9 <!-- 10 This test verifies that inline modulepreload elements (statically declared in HTML) 11 correctly handle referrer policies. It tests: 12 13 1. Default behavior (no referrerpolicy attribute) - should use origin or full URL depending on implementation 14 2. origin referrerpolicy - should use only origin 15 3. no-referrer referrerpolicy - should not send referrer 16 4. Document-level referrer policy (via meta tag) - should be respected 17 18 Unlike the other modulepreload referrer tests that create elements dynamically, 19 this test uses inline link elements in the HTML. 20 --> 21 <script src="/resources/testharness.js"></script> 22 <script src="/resources/testharnessreport.js"></script> 23 <script> 24 // Initialize the window.referrers object that will be used by echo-referrer.py 25 window.referrers = {}; 26 27 // Create unique IDs for each test 28 const noReferrerPolicyId = Date.now(); 29 const originPolicyId = Date.now() + 1; 30 const noReferrerId = Date.now() + 2; 31 const originId = Date.now() + 3; 32 </script> 33 34 <!-- Test with no referrerpolicy attribute (should use document default) --> 35 <link rel="modulepreload" href="/preload/resources/echo-referrer.py?uid=NOPOLICY_ID"> 36 37 <!-- Test with origin referrerpolicy attribute --> 38 <link rel="modulepreload" href="/preload/resources/echo-referrer.py?uid=ORIGIN_ID" referrerpolicy="origin"> 39 40 <!-- Test with no-referrer referrerpolicy attribute --> 41 <link rel="modulepreload" href="/preload/resources/echo-referrer.py?uid=NOREFERRER_ID" referrerpolicy="no-referrer"> 42 43 <!-- For document policy test, add meta tag for origin referrer policy --> 44 <meta name="referrer" content="origin"> 45 <link rel="modulepreload" href="/preload/resources/echo-referrer.py?uid=DOC_POLICY_ID"> 46 47 <script> 48 // Replace placeholder IDs with actual IDs in the HTML 49 document.documentElement.innerHTML = document.documentElement.innerHTML 50 .replace('NOPOLICY_ID', noReferrerPolicyId) 51 .replace('ORIGIN_ID', originPolicyId) 52 .replace('NOREFERRER_ID', noReferrerId) 53 .replace('DOC_POLICY_ID', originId); 54 </script> 55 </head> 56 <body> 57 <script> 58 // Ensure modules are loaded by importing them 59 promise_test(async t => { 60 await Promise.all([ 61 import(`/preload/resources/echo-referrer.py?uid=${noReferrerPolicyId}`), 62 import(`/preload/resources/echo-referrer.py?uid=${originPolicyId}`), 63 import(`/preload/resources/echo-referrer.py?uid=${noReferrerId}`), 64 import(`/preload/resources/echo-referrer.py?uid=${originId}`) 65 ]); 66 67 // Test that module with no specified referrerpolicy 68 // Note: Some implementations may send only origin for inline modulepreload requests 69 const expectedDefault = location.origin + "/"; 70 assert_equals(window.referrers[noReferrerPolicyId], expectedDefault, 71 "Modulepreload with no referrerpolicy should use expected referrer"); 72 73 // Test that module with origin referrerpolicy sends only origin 74 assert_equals(window.referrers[originPolicyId], location.origin + "/", 75 "Modulepreload with origin referrerpolicy should send origin only"); 76 77 // Test that module with no-referrer policy sends no referrer 78 assert_equals(window.referrers[noReferrerId], "", 79 "Modulepreload with no-referrer referrerpolicy should not send referrer"); 80 81 // Test that module with no policy but document policy uses document policy 82 assert_equals(window.referrers[originId], location.origin + "/", 83 "Modulepreload with no referrerpolicy should use document's policy"); 84 85 }, "Inline modulepreload elements should respect the referrerpolicy attribute"); 86 </script> 87 </body> 88 </html>