Source code

Revision control

Copy as Markdown

Other Tools

Test Info: Warnings

// META: script=/common/get-host-info.sub.js
// META: script=/service-workers/service-worker/resources/test-helpers.sub.js
// META: script=resources/utils.js
'use strict';
// Verifies Background Fetch enforcement of standard CORS security rules,
// including preflights, exposed headers, response types, and credentials mode.
const {HTTPS_REMOTE_ORIGIN} = get_host_info();
const kCorsResource =
HTTPS_REMOTE_ORIGIN + '/background-fetch/resources/cors-resource.txt';
const kNoCorsResource =
HTTPS_REMOTE_ORIGIN + '/background-fetch/resources/feature-name.txt';
backgroundFetchTest(
async (test, bgFetch) => {
await bgFetch.fetch(uniqueId(), kCorsResource);
const event = await getMessageFromServiceWorker();
assert_equals(event.type, 'backgroundfetchsuccess');
assert_equals(event.results.length, 1);
assert_equals(event.results[0].type, 'cors');
assert_equals(event.results[0].secretHeader, null);
},
'Cross-origin response type is cors and non-CORS-exposed headers are filtered',
'sw-cors.js');
backgroundFetchTest(async (test, bgFetch) => {
await bgFetch.fetch(uniqueId(), kNoCorsResource);
const event = await getMessageFromServiceWorker();
assert_equals(event.type, 'backgroundfetchfail');
}, 'Cross-origin Background Fetch fails without CORS headers', 'sw-cors.js');
backgroundFetchTest(
async (test, bgFetch) => {
const request = new Request(
kCorsResource, {headers: {'X-Custom-Header': 'SecretValue'}});
await bgFetch.fetch(uniqueId(), request);
const event = await getMessageFromServiceWorker();
assert_equals(event.type, 'backgroundfetchfail');
},
'Cross-origin Background Fetch with custom headers fails without preflight approval',
'sw-cors.js');
backgroundFetchTest(
async (test, bgFetch) => {
const request = new Request(kCorsResource, {credentials: 'include'});
await bgFetch.fetch(uniqueId(), request);
const event = await getMessageFromServiceWorker();
assert_equals(event.type, 'backgroundfetchfail');
},
'Cross-origin Background Fetch with credentials mode include fails against wildcard Origin',
'sw-cors.js');
backgroundFetchTest(
async (test, bgFetch) => {
const request = new Request(kCorsResource, {credentials: 'omit'});
await bgFetch.fetch(uniqueId(), request);
const event = await getMessageFromServiceWorker();
assert_equals(event.type, 'backgroundfetchsuccess');
},
'Cross-origin Background Fetch with credentials mode omit succeeds against wildcard Origin',
'sw-cors.js');