Source code
Revision control
Copy as Markdown
Other Tools
Test Info: Warnings
- This test has a WPT meta file that expects 63 subtest issues.
- This WPT test may be referenced by the following Test IDs:
- /service-workers/service-worker/same-site-cookies.https.html - WPT Dashboard Interop Dashboard
<!DOCTYPE html>
<meta charset="utf-8"/>
<meta name="timeout" content="long">
<title>Service Worker: Same-site cookie behavior</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/common/get-host-info.sub.js"></script>
<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
<script src="/cookies/resources/cookie-helper.sub.js"></script>
<body>
<script>
'use strict';
const COOKIE_VALUE = 'COOKIE_VALUE';
function make_nested_url(nested_origins, target_url) {
for (let i = nested_origins.length - 1; i >= 0; --i) {
target_url = new URL(
`./resources/nested-parent.html?target=${encodeURIComponent(target_url)}`,
nested_origins[i] + self.location.pathname);
}
return target_url;
}
const scopepath = '/cookies/resources/postToParent.py?with-sw';
async function unregister_service_worker(origin, nested_origins=[]) {
let target_url = origin +
'/service-workers/service-worker/resources/unregister-rewrite-worker.html' +
'?scopepath=' + encodeURIComponent(scopepath);
target_url = make_nested_url(nested_origins, target_url);
const w = window.open(target_url);
try {
await wait_for_message('SW-UNREGISTERED');
} finally {
w.close();
}
}
async function register_service_worker(origin, nested_origins=[]) {
let target_url = origin +
'/service-workers/service-worker/resources/register-rewrite-worker.html' +
'?scopepath=' + encodeURIComponent(scopepath);
target_url = make_nested_url(nested_origins, target_url);
const w = window.open(target_url);
try {
await wait_for_message('SW-REGISTERED');
} finally {
w.close();
}
}
async function run_test(t, origin, navaction, swaction, expected,
redirect_origins=[], nested_origins=[]) {
if (swaction === 'navpreload') {
assert_true('navigationPreload' in ServiceWorkerRegistration.prototype,
'navigation preload must be supported');
}
const sw_param = swaction === 'no-sw' ? 'no-sw' : 'with-sw';
let action_param = '';
if (swaction === 'fallback') {
action_param = '&ignore';
} else if (swaction !== 'no-sw') {
action_param = '&' + swaction;
}
const navpreload_param = swaction === 'navpreload' ? '&navpreload' : '';
const change_request_param = swaction === 'change-request' ? '&change-request' : '';
const target_string = origin + `/cookies/resources/postToParent.py?` +
`${sw_param}${action_param}`
let target_url = new URL(target_string);
for (let i = redirect_origins.length - 1; i >= 0; --i) {
const redirect_url = new URL(
`./resources/redirect.py?Status=307&Redirect=${encodeURIComponent(target_url)}`,
redirect_origins[i] + self.location.pathname);
target_url = redirect_url;
}
if (navaction === 'window.open') {
target_url = new URL(
`./resources/window-opener.html?target=${encodeURIComponent(target_url)}`,
self.origin + self.location.pathname);
} else if (navaction === 'form post') {
target_url = new URL(
`./resources/form-poster.html?target=${encodeURIComponent(target_url)}`,
self.origin + self.location.pathname);
} else if (navaction === 'set location') {
target_url = new URL(
`./resources/location-setter.html?target=${encodeURIComponent(target_url)}`,
self.origin + self.location.pathname);
}
const w = window.open(make_nested_url(nested_origins, target_url));
t.add_cleanup(() => w.close());
const result = await wait_for_message('COOKIES');
verifySameSiteCookieState(expected, COOKIE_VALUE, result.data);
}
promise_test(async t => {
await resetSameSiteCookies(self.origin, COOKIE_VALUE);
await register_service_worker(self.origin);
await resetSameSiteCookies(SECURE_SUBDOMAIN_ORIGIN, COOKIE_VALUE);
await register_service_worker(SECURE_SUBDOMAIN_ORIGIN);
await resetSameSiteCookies(SECURE_CROSS_SITE_ORIGIN, COOKIE_VALUE);
await register_service_worker(SECURE_CROSS_SITE_ORIGIN);
await register_service_worker(self.origin,
[self.origin, SECURE_CROSS_SITE_ORIGIN]);
}, 'Setup service workers');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'no-sw',
SameSiteStatus.STRICT);
}, 'same-origin, window.open with no service worker');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'fallback',
SameSiteStatus.STRICT);
}, 'same-origin, window.open with fallback');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'passthrough',
SameSiteStatus.STRICT);
}, 'same-origin, window.open with passthrough');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'change-request',
SameSiteStatus.STRICT);
}, 'same-origin, window.open with change-request');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'navpreload',
SameSiteStatus.STRICT);
}, 'same-origin, window.open with navpreload');
promise_test(t => {
return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'no-sw',
SameSiteStatus.STRICT);
}, 'same-site, window.open with no service worker');
promise_test(t => {
return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'fallback',
SameSiteStatus.STRICT);
}, 'same-site, window.open with fallback');
promise_test(t => {
return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'passthrough',
SameSiteStatus.STRICT);
}, 'same-site, window.open with passthrough');
promise_test(t => {
return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'change-request',
SameSiteStatus.STRICT);
}, 'same-site, window.open with change-request');
promise_test(t => {
return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'window.open', 'navpreload',
SameSiteStatus.STRICT);
}, 'same-site, window.open with navpreload');
promise_test(t => {
return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'no-sw',
SameSiteStatus.LAX);
}, 'cross-site, window.open with no service worker');
promise_test(t => {
return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'fallback',
SameSiteStatus.LAX);
}, 'cross-site, window.open with fallback');
promise_test(t => {
return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'passthrough',
SameSiteStatus.LAX);
}, 'cross-site, window.open with passthrough');
promise_test(t => {
return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'change-request',
SameSiteStatus.STRICT);
}, 'cross-site, window.open with change-request');
promise_test(t => {
return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'window.open', 'navpreload',
SameSiteStatus.LAX);
}, 'cross-site, window.open with navpreload');
//
// window.open redirect tests
//
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'no-sw',
SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
}, 'same-origin, window.open with no service worker and same-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'fallback',
SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
}, 'same-origin, window.open with fallback and same-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'passthrough',
SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
}, 'same-origin, window.open with passthrough and same-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'change-request',
SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
}, 'same-origin, window.open with change-request and same-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'navpreload',
SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
}, 'same-origin, window.open with navpreload and same-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'no-sw',
SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, window.open with no service worker and cross-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'fallback',
SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, window.open with fallback and cross-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'passthrough',
SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, window.open with passthrough and cross-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'change-request',
SameSiteStatus.STRICT, [SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, window.open with change-request and cross-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'navpreload',
SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, window.open with navpreload and cross-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'no-sw',
SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
}, 'same-origin, window.open with no service worker, cross-site redirect, and ' +
'same-origin redirect');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'fallback',
SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
}, 'same-origin, window.open with fallback, cross-site redirect, and ' +
'same-origin redirect');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'passthrough',
SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
}, 'same-origin, window.open with passthrough, cross-site redirect, and ' +
'same-origin redirect');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'change-request',
SameSiteStatus.STRICT, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
}, 'same-origin, window.open with change-request, cross-site redirect, and ' +
'same-origin redirect');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'navpreload',
SameSiteStatus.LAX, [SECURE_CROSS_SITE_ORIGIN, self.origin]);
}, 'same-origin, window.open with navpreload, cross-site redirect, and ' +
'same-origin redirect');
//
// Double-nested frame calling open.window() tests
//
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'no-sw',
SameSiteStatus.STRICT, [],
[self.origin, SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, nested window.open with cross-site middle frame and ' +
'no service worker');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'fallback',
SameSiteStatus.STRICT, [],
[self.origin, SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, nested window.open with cross-site middle frame and ' +
'fallback service worker');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'passthrough',
SameSiteStatus.STRICT, [],
[self.origin, SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, nested window.open with cross-site middle frame and ' +
'passthrough service worker');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'change-request',
SameSiteStatus.STRICT, [],
[self.origin, SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, nested window.open with cross-site middle frame and ' +
'change-request service worker');
promise_test(t => {
return run_test(t, self.origin, 'window.open', 'navpreload',
SameSiteStatus.STRICT, [],
[self.origin, SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, nested window.open with cross-site middle frame and ' +
'navpreload service worker');
//
// Double-nested frame setting location tests
//
promise_test(t => {
return run_test(t, self.origin, 'set location', 'no-sw',
SameSiteStatus.CROSS_SITE, [],
[self.origin, SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, nested set location with cross-site middle frame and ' +
'no service worker');
promise_test(t => {
return run_test(t, self.origin, 'set location', 'fallback',
SameSiteStatus.CROSS_SITE, [],
[self.origin, SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, nested set location with cross-site middle frame and ' +
'fallback service worker');
promise_test(t => {
return run_test(t, self.origin, 'set location', 'passthrough',
SameSiteStatus.CROSS_SITE, [],
[self.origin, SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, nested set location with cross-site middle frame and ' +
'passthrough service worker');
promise_test(t => {
return run_test(t, self.origin, 'set location', 'change-request',
SameSiteStatus.CROSS_SITE, [],
[self.origin, SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, nested set location with cross-site middle frame and ' +
'change-request service worker');
promise_test(t => {
return run_test(t, self.origin, 'set location', 'navpreload',
SameSiteStatus.CROSS_SITE, [],
[self.origin, SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, nested set location with cross-site middle frame and ' +
'navpreload service worker');
//
// Form POST tests
//
promise_test(t => {
return run_test(t, self.origin, 'form post', 'no-sw', SameSiteStatus.STRICT);
}, 'same-origin, form post with no service worker');
promise_test(t => {
return run_test(t, self.origin, 'form post', 'fallback',
SameSiteStatus.STRICT);
}, 'same-origin, form post with fallback');
promise_test(t => {
return run_test(t, self.origin, 'form post', 'passthrough',
SameSiteStatus.STRICT);
}, 'same-origin, form post with passthrough');
promise_test(t => {
return run_test(t, self.origin, 'form post', 'change-request',
SameSiteStatus.STRICT);
}, 'same-origin, form post with change-request');
promise_test(t => {
return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'form post', 'no-sw',
SameSiteStatus.STRICT);
}, 'same-site, form post with no service worker');
promise_test(t => {
return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'form post', 'fallback',
SameSiteStatus.STRICT);
}, 'same-site, form post with fallback');
promise_test(t => {
return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'form post', 'passthrough',
SameSiteStatus.STRICT);
}, 'same-site, form post with passthrough');
promise_test(t => {
return run_test(t, SECURE_SUBDOMAIN_ORIGIN, 'form post', 'change-request',
SameSiteStatus.STRICT);
}, 'same-site, form post with change-request');
promise_test(t => {
return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'form post', 'no-sw',
SameSiteStatus.CROSS_SITE);
}, 'cross-site, form post with no service worker');
promise_test(t => {
return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'form post', 'fallback',
SameSiteStatus.CROSS_SITE);
}, 'cross-site, form post with fallback');
promise_test(t => {
return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'form post', 'passthrough',
SameSiteStatus.CROSS_SITE);
}, 'cross-site, form post with passthrough');
promise_test(t => {
return run_test(t, SECURE_CROSS_SITE_ORIGIN, 'form post', 'change-request',
SameSiteStatus.STRICT);
}, 'cross-site, form post with change-request');
//
// Form POST redirect tests
//
promise_test(t => {
return run_test(t, self.origin, 'form post', 'no-sw',
SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
}, 'same-origin, form post with no service worker and same-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'form post', 'fallback',
SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
}, 'same-origin, form post with fallback and same-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'form post', 'passthrough',
SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
}, 'same-origin, form post with passthrough and same-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'form post', 'change-request',
SameSiteStatus.STRICT, [SECURE_SUBDOMAIN_ORIGIN]);
}, 'same-origin, form post with change-request and same-site redirect');
// navpreload is not supported for POST requests
promise_test(t => {
return run_test(t, self.origin, 'form post', 'no-sw',
SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, form post with no service worker and cross-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'form post', 'fallback',
SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, form post with fallback and cross-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'form post', 'passthrough',
SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, form post with passthrough and cross-site redirect');
promise_test(t => {
return run_test(t, self.origin, 'form post', 'change-request',
SameSiteStatus.STRICT, [SECURE_CROSS_SITE_ORIGIN]);
}, 'same-origin, form post with change-request and cross-site redirect');
// navpreload is not supported for POST requests
promise_test(t => {
return run_test(t, self.origin, 'form post', 'no-sw',
SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN,
self.origin]);
}, 'same-origin, form post with no service worker, cross-site redirect, and ' +
'same-origin redirect');
promise_test(t => {
return run_test(t, self.origin, 'form post', 'fallback',
SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN,
self.origin]);
}, 'same-origin, form post with fallback, cross-site redirect, and ' +
'same-origin redirect');
promise_test(t => {
return run_test(t, self.origin, 'form post', 'passthrough',
SameSiteStatus.CROSS_SITE, [SECURE_CROSS_SITE_ORIGIN,
self.origin]);
}, 'same-origin, form post with passthrough, cross-site redirect, and ' +
'same-origin redirect');
promise_test(t => {
return run_test(t, self.origin, 'form post', 'change-request',
SameSiteStatus.STRICT, [SECURE_CROSS_SITE_ORIGIN,
self.origin]);
}, 'same-origin, form post with change-request, cross-site redirect, and ' +
'same-origin redirect');
// navpreload is not supported for POST requests
promise_test(async t => {
await unregister_service_worker(self.origin);
await unregister_service_worker(SECURE_SUBDOMAIN_ORIGIN);
await unregister_service_worker(SECURE_CROSS_SITE_ORIGIN);
await unregister_service_worker(self.origin,
[self.origin, SECURE_CROSS_SITE_ORIGIN]);
}, 'Cleanup service workers');
</script>
</body>