Source code
Revision control
Copy as Markdown
Other Tools
Test Info:
- This WPT test may be referenced by the following Test IDs:
- /html/cross-origin-embedder-policy/credentialless/dedicated-worker.https.window.html - WPT Dashboard Interop Dashboard
// META: timeout=long
// META: script=/common/get-host-info.sub.js
// META: script=/common/utils.js
// META: script=/common/dispatcher/dispatcher.js
// META: script=./resources/common.js
const same_origin = get_host_info().HTTPS_ORIGIN;
const cross_origin = get_host_info().HTTPS_REMOTE_ORIGIN;
const cookie_key = "credentialless_dedicated_worker";
const cookie_same_origin = "same_origin";
const cookie_cross_origin = "cross_origin";
promise_test(async test => {
await Promise.all([
setCookie(same_origin, cookie_key, cookie_same_origin +
cookie_same_site_none),
setCookie(cross_origin, cookie_key, cookie_cross_origin +
cookie_same_site_none),
]);
// One window with COEP:none. (control)
const w_control_token = token();
const w_control_url = same_origin + executor_path +
coep_none + `&uuid=${w_control_token}`
const w_control = window.open(w_control_url);
add_completion_callback(() => w_control.close());
// One window with COEP:credentialless. (experiment)
const w_credentialless_token = token();
const w_credentialless_url = same_origin + executor_path +
coep_credentialless + `&uuid=${w_credentialless_token}`;
const w_credentialless = window.open(w_credentialless_url);
add_completion_callback(() => w_credentialless.close());
let GetCookie = (response) => {
const headers_credentialless = JSON.parse(response);
return parseCookies(headers_credentialless)[cookie_key];
}
const dedicatedWorkerTest = function(
description, origin, coep_for_worker,
expected_cookies_control,
expected_cookies_credentialless) {
promise_test_parallel(async t => {
// Create workers for both window.
const worker_token_1 = token();
const worker_token_2 = token();
// Used to check for errors creating the DedicatedWorker.
const worker_error_1 = token();
const worker_error_2 = token();
const w_worker_src_1 = same_origin + executor_worker_path +
coep_for_worker + `&uuid=${worker_token_1}`;
send(w_control_token, `
new Worker("${w_worker_src_1}", {});
worker.onerror = () => {
send("${worker_error_1}", "Worker blocked");
}
`);
const w_worker_src_2 = same_origin + executor_worker_path +
coep_for_worker + `&uuid=${worker_token_2}`;
send(w_credentialless_token, `
const worker = new Worker("${w_worker_src_2}", {});
worker.onerror = () => {
send("${worker_error_2}", "Worker blocked");
}
`);
// Fetch resources with the workers.
const request_token_1 = token();
const request_token_2 = token();
const request_url_1 = showRequestHeaders(origin, request_token_1);
const request_url_2 = showRequestHeaders(origin, request_token_2);
send(worker_token_1, `
fetch("${request_url_1}", {mode: 'no-cors', credentials: 'include'})
`);
send(worker_token_2, `
fetch("${request_url_2}", {mode: 'no-cors', credentials: 'include'});
`);
const response_control = await Promise.race([
receive(worker_error_1),
receive(request_token_1).then(GetCookie)
]);
assert_equals(response_control,
expected_cookies_control,
"coep:none => ");
const response_credentialless = await Promise.race([
receive(worker_error_2),
receive(request_token_2).then(GetCookie)
]);
assert_equals(response_credentialless,
expected_cookies_credentialless,
"coep:credentialless => ");
}, `fetch ${description}`)
};
dedicatedWorkerTest("same-origin + credentialless worker",
same_origin, coep_credentialless,
cookie_same_origin,
cookie_same_origin);
dedicatedWorkerTest("same-origin + require_corp worker",
same_origin, coep_require_corp,
cookie_same_origin,
cookie_same_origin);
dedicatedWorkerTest("same-origin",
same_origin, coep_none,
cookie_same_origin,
"Worker blocked");
dedicatedWorkerTest("cross-origin",
cross_origin, coep_none,
cookie_cross_origin,
"Worker blocked" // Owner's policy is credentialles, so we can't
// create a worker with coep_none.
);
dedicatedWorkerTest("cross-origin + credentialless worker",
cross_origin, coep_credentialless,
undefined, // Worker created successfully with credentialless, and fetch doesn't get credentials
undefined // Worker created successfully with credentialless, and fetch doesn't get credentials
);
dedicatedWorkerTest("cross-origin + require_corp worker",
cross_origin, coep_require_corp,
cookie_cross_origin,
cookie_cross_origin // The worker's policy is require_corp and doing a
// fetch within it has nothing to do with the Owner's policy.
);
})