requestStorageAccess-cross-site-fetch.sub.https.window.js (2544B)
1 // META: script=helpers.js 2 // META: script=/cookies/resources/cookie-helper.sub.js 3 // META: script=/resources/testdriver.js 4 // META: script=/resources/testdriver-vendor.js 5 'use strict'; 6 7 const mainHost = "https://{{host}}:{{ports[https][0]}}"; 8 const altRoot = "https://{{hosts[alt][]}}:{{ports[https][0]}}"; 9 const responderPath = "/storage-access-api/resources/script-with-cookie-header.py?script=embedded_responder.js"; 10 11 const altRootResponder = `${altRoot}${responderPath}`; 12 const domainCookieString = "cookie=unpartitioned;Secure;SameSite=None;Path=/;Domain={{hosts[alt][]}}"; 13 14 async function SetUpResponderFrame(t, url) { 15 const frame = await CreateFrame(url); 16 17 t.add_cleanup(async () => { 18 await test_driver.delete_all_cookies(); 19 await SetPermissionInFrame(frame, [{ name: 'storage-access' }, 'prompt']); 20 await DeleteCookieInFrame(frame, "cookie", "Secure;SameSite=None;Path=/;Domain={{hosts[alt][]}}"); 21 }); 22 23 return frame; 24 } 25 26 promise_test(async (t) => { 27 await SetFirstPartyCookie(altRoot, "initial-cookie=unpartitioned;Secure;SameSite=None;Path=/"); 28 const frame = await SetUpResponderFrame(t, altRootResponder); 29 await SetDocumentCookieFromFrame(frame, domainCookieString); 30 31 const initiallyHasCookieAccess = 32 cookieStringHasCookie("cookie", "unpartitioned", 33 await FetchSubresourceCookiesFromFrame(frame, altRoot)); 34 if (initiallyHasCookieAccess) { 35 // Nothing to test here; third-party cookies are already accessible. 36 return; 37 } 38 39 await SetPermissionInFrame(frame, [{ name: 'storage-access' }, 'granted']); 40 41 assert_true(await RequestStorageAccessInFrame(frame), "requestStorageAccess resolves without requiring a gesture."); 42 assert_true(await FrameHasStorageAccess(frame), "frame has storage access after request."); 43 await SetDocumentCookieFromFrame(frame, domainCookieString); 44 assert_true(await HasUnpartitionedCookie(frame), "frame has access to cookies after request."); 45 46 // Redirect back to the iframe's origin, via a cross-site redirect. The 47 // frame's origin is `{{hosts[alt][]}}`, so `{{host}}` is cross-site to it. 48 const dest = `${altRoot}/storage-access-api/resources/echo-cookie-header.py`; 49 const redirect = `${mainHost}/common/redirect.py?enable-cors=&location=${encodeURIComponent(dest)}`; 50 assert_false( 51 cookieStringHasCookie("cookie", "unpartitioned", 52 await FetchFromFrame(frame, redirect)), 53 "fetch is not credentialed after a cross-site redirect"); 54 }, "Cross-site HTTP redirects from a frame with storage-access are not credentialed by default");