refresh-cross-origin.sub.html (2111B)
1 <!doctype html> 2 <meta charset="utf-8"> 3 <title>Cross-Origin Referrer Policy applied to Refresh</title> 4 <link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=266554"> 5 <link rel="help" href="https://w3c.github.io/webappsec-referrer-policy/#determine-requests-referrer"> 6 <link rel="help" href="https://html.spec.whatwg.org/multipage/browsing-the-web.html#populating-a-session-history-entry:concept-request"> 7 <link rel="help" href="https://github.com/privacycg/proposals/issues/13"> 8 <link rel="author" title="Zach Hoffman" href="mailto:zach@zrhoffman.net"> 9 <script src="/resources/testharness.js"></script> 10 <script src="/resources/testharnessreport.js"></script> 11 <script src="./resources/refresh-by-host.js"></script> 12 <body> 13 <script> 14 const ports = { 15 http: "{{ports[http][0]}}", 16 https: "{{ports[https][0]}}", 17 }; 18 19 let scheme; 20 const originScheme = location.protocol.slice(0, -1); 21 if (originScheme === "http") { 22 scheme = originScheme; 23 } else { 24 scheme = "https"; 25 } 26 const port = ports[scheme]; 27 28 const origin = `${scheme}://{{hosts[alt][]}}:${port}`; 29 const path = "resources/referrer-info.sub.html"; 30 const base = new URL(location.pathname, origin); 31 const url = new URL(path, base).href; 32 const expectationsByPolicy = { 33 "no-referrer": kExpectEmptyString, 34 // WebKit and Gecko send the origin for no-referrer-when-downgrade Referrer Policy refreshes in an 35 // iframe, but per the spec, the full URL should be sent in this case. Further discussion: 36 // <https://github.com/privacycg/proposals/issues/13> 37 "no-referrer-when-downgrade": kExpectFullURL, 38 "origin": kExpectOrigin, 39 "origin-when-cross-origin": kExpectOrigin, 40 "same-origin": kExpectEmptyString, 41 "strict-origin": kExpectOrigin, 42 "strict-origin-when-cross-origin": kExpectOrigin, 43 // WebKit and Gecko send the origin for unsafe-url Referrer Policy refreshes in an iframe, but per 44 // the spec, the full URL should be sent in this case. Further discussion: 45 // <https://github.com/privacycg/proposals/issues/13> 46 "unsafe-url": kExpectFullURL, 47 "": kExpectOrigin, 48 }; 49 50 refreshWithPoliciesTest(url, expectationsByPolicy); 51 </script>