sandbox.https.html

Enable keyboard shortcuts

This WPT test may be referenced by the following Test IDs:
- /html/cross-origin-embedder-policy/sandbox.https.html - WPT Dashboard Interop Dashboard

<!doctype html>

<meta charset=utf-8>

<script src="/resources/testharness.js"></script>

<script src="/resources/testharnessreport.js"></script>

<script src="/common/get-host-info.sub.js"></script>

<div id=log></div>

<script>

async_test(t => {

  window.addEventListener("message", t.step_func_done(({ data }) => {

    assert_equals(data.origin, "null");

    assert_true(data.sameOriginWithoutCORP, "Request to same-origin resource without CORP did not fail");

    assert_true(data.sameOriginWithSameOriginCORP, "Request to same-origin resource with same-origin CORP did not fail");

    assert_true(data.sameOriginWithCrossOriginCORP, "Request to same-origin resource with cross-origin CORP did not succeed");

    assert_true(data.crossOriginWithCrossOriginCORP, "Request to cross-origin resource with cross-origin CORP did not succeed");

  }));

  const origins = get_host_info();

  const frame = document.createElement("iframe");

  const nothingCrossOriginCORP = new URL("resources/nothing-cross-origin-corp.js", window.location).pathname;

  const nothingSameOriginCORP = new URL("resources/nothing-same-origin-corp.txt", window.location).pathname;

  frame.sandbox = "allow-scripts";

  frame.srcdoc = `<script>

const data = { sameOriginWithoutCORP: false,

               sameOriginWithSameOriginCORP: false,

               sameOriginWithCrossOriginCORP: false,

               crossOriginWithCrossOriginCORP: false,

               origin: self.origin };

function record(promise, token, expectation) {

  return promise.then(() => data[token] = expectation, () => data[token] = !expectation);

Promise.all([

  record(fetch("/common/blank.html", { mode: "no-cors" }), "sameOriginWithoutCORP", false),

  record(fetch("${nothingSameOriginCORP}", { mode: "no-cors" }), "sameOriginWithSameOriginCORP", false),

  record(fetch("${nothingCrossOriginCORP}", { mode: "no-cors" }), "sameOriginWithCrossOriginCORP", true),

  record(fetch("${origins.HTTPS_NOTSAMESITE_ORIGIN}${nothingCrossOriginCORP}", { mode: "no-cors" }), "crossOriginWithCrossOriginCORP", true)

]).then(() => parent.postMessage(data, "*"));

<\/script>`;

  document.body.append(frame);

}, "Cross-Origin-Embedder-Policy and sandbox");

</script>