1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
<!doctype html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/common/utils.js"></script>
<script src="/shared-storage/resources/util.js"></script>
<script src="/fenced-frame/resources/utils.js"></script>
<body>
<script>
'use strict';
async function verifyStoreCookieCrossOriginCreateWorkletOmitCredentials(
helper_url_params, data_origin_option) {
const ancestor_key = token();
const crossOrigin = 'https://{{domains[www]}}:{{ports[https][0]}}';
const set_cookie_url = crossOrigin + `/cookies/resources/set-cookie.py` +
`?name=key0` +
`&path=/shared-storage/`;
const helper_url = crossOrigin +
`/shared-storage/resources/credentials-test-helper.py` +
helper_url_params + `&token=${ancestor_key}`;
await fetch(set_cookie_url, { mode: 'no-cors', credentials: 'include' });
const options = (data_origin_option === '') ? { credentials: "omit" }
: { credentials: "omit", dataOrigin: data_origin_option };
const worklet = await sharedStorage.createWorklet(
helper_url + `&action=store-cookie`, options);
const request_cookie_fetch_response =
await fetch(helper_url + `&action=get-cookie`);
const request_cookie_text = await request_cookie_fetch_response.text();
assert_equals(request_cookie_text, "NO_COOKIE_HEADER");
}
promise_test(async () => {
const helper_url_params =
`?access_control_allow_origin_header=${window.origin}` +
`&access_control_allow_credentials_header=true`;
await verifyStoreCookieCrossOriginCreateWorkletOmitCredentials(
helper_url_params, /*data_origin_option=*/'');
}, 'createWorklet() with cross-origin module script, credentials "omit",'
+ 'and default data origin (context origin).');
promise_test(async () => {
const helper_url_params =
`?access_control_allow_origin_header=${window.origin}` +
`&access_control_allow_credentials_header=true`;
await verifyStoreCookieCrossOriginCreateWorkletOmitCredentials(
helper_url_params, /*data_origin_option=*/'context-origin');
}, 'createWorklet() with cross-origin module script, credentials "omit",'
+ 'and "context-origin" as dataOrigin.');
promise_test(async () => {
const helper_url_params =
`?access_control_allow_origin_header=${window.origin}` +
`&access_control_allow_credentials_header=true` +
`&shared_storage_cross_origin_worklet_allowed_header=?1`;
await verifyStoreCookieCrossOriginCreateWorkletOmitCredentials(
helper_url_params, /*data_origin_option=*/'script-origin');
}, 'createWorklet() with cross-origin module script, credentials "omit",'
+ 'and "script-origin" as dataOrigin.');
</script>
</body>
|
