Source code
Revision control
Copy as Markdown
Other Tools
Test Info:
- This WPT test may be referenced by the following Test IDs:
- /cookies/path/match-segment-boundaries.https.window.html - WPT Dashboard Interop Dashboard
// META: title=Cookie Path attribute matching only at path segment boundaries
'use strict';
// A cookie is only sent when its path is the request URL's path, or a prefix of
// it that ends at a path segment boundary. In particular a cookie path that is
// longer than the request URL's path never matches, even when the request URL's
// path is a prefix of it.
//
const DIR = '/cookies/path/resources';
const TARGET = `${DIR}/echo.py`;
const NAME_PREFIX = 'segment-boundaries-';
async function setCookieViaHTTP(cookie) {
const set = encodeURIComponent(JSON.stringify([cookie]));
const response = await fetch(`/cookies/resources/cookie.py?set=${set}`);
assert_true(response.ok, 'Setting the cookie via HTTP succeeded');
}
// The Cookie header the server receives for a request to TARGET.
async function cookieHeaderAtTarget() {
const response = await fetch(TARGET, {credentials: 'include'});
assert_true(response.ok, 'Reading the Cookie header succeeded');
return (await response.text()).trim();
}
function cookieValue(cookieString, name) {
for (const pair of cookieString.split('; ')) {
const index = pair.indexOf('=');
if (index !== -1 && pair.substring(0, index) === name) {
return pair.substring(index + 1);
}
}
return null;
}
// Sets the cookie under test, then expires it again through the same Path, which
// is what removes it.
function pathTest({name, suffix, path, sent}) {
const cookieName = NAME_PREFIX + suffix;
promise_test(async t => {
t.add_cleanup(
() => setCookieViaHTTP(`${cookieName}=; Path=${path}; Max-Age=0`));
await setCookieViaHTTP(`${cookieName}=1; Path=${path}`);
assert_equals(cookieValue(await cookieHeaderAtTarget(), cookieName),
sent ? '1' : null);
}, name);
}
pathTest({
name: 'A Path equal to the request path matches',
suffix: 'exact',
path: TARGET,
sent: true,
});
pathTest({
name: 'A Path that is a prefix ending at a segment boundary matches',
suffix: 'prefix',
path: DIR,
sent: true,
});
pathTest({
name: 'A Path that is a prefix ending in a slash matches',
suffix: 'trailingslash',
path: `${DIR}/`,
sent: true,
});
// The request path continues with ".py" rather than a "/", so the cookie path is
// not a prefix ending at a segment boundary.
pathTest({
name: 'A Path that is a prefix not ending at a segment boundary does not match',
suffix: 'midsegment',
path: `${DIR}/echo`,
sent: false,
});
// The request path is a prefix of the cookie path rather than the other way
// around. A cookie path longer than the request path can never match.
pathTest({
name: 'A Path that is the request path followed by a slash does not match',
suffix: 'longerslash',
path: `${TARGET}/`,
sent: false,
});
pathTest({
name: 'A Path that is the request path followed by a segment does not match',
suffix: 'longersegment',
path: `${TARGET}/sub`,
sent: false,
});