{ "test_description_template": "Referrer Policy: Expects %(expectation)s for %(subresource)s to %(origin)s origin and %(redirection)s redirection from %(source_scheme)s context.", "test_page_title_template": "Referrer-Policy: %(title)s", "specification": [ { // unset-referrer-policy "title": "Referrer Policy is not explicitly defined", "description": "Check that referrer URL follows the strict-origin-when-cross-origin policy when no explicit Referrer Policy is set.", "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policies", "test_expansion": [ { // same-insecure "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": null, "redirection": "*", "origin": "same-http", "subresource": "*", "expectation": "stripped-referrer" }, { // same-insecure "expansion": "override", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": null, "redirection": "swap-origin", "origin": "same-http", "subresource": "*", "expectation": "origin" }, { // cross-insecure "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": null, "redirection": "*", "origin": "cross-http", "subresource": "*", "expectation": "origin" }, { // upgrade-protocol "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": null, "redirection": "*", "origin": [ "same-https", "cross-https" ], "subresource": "*", "expectation": "origin" }, { // downgrade-protocol "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": null, "redirection": "*", "origin": [ "same-http", "cross-http" ], "subresource": "*", "expectation": "omitted" }, { // same-secure "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": null, "redirection": "*", "origin": "same-https", "subresource": "*", "expectation": "stripped-referrer" }, { // same-secure "expansion": "override", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": null, "redirection": "swap-origin", "origin": "same-https", "subresource": "*", "expectation": "origin" }, { // cross-secure "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": null, "redirection": "*", "origin": "cross-https", "subresource": "*", "expectation": "origin" } ] }, { // meta tag default "title": " is set to the legacy keyword 'default'", "description": "Check that the 'default' legacy keyword results in behavior equivalent to the default policy (currently strict-origin-when-cross-origin)", "specification_url": "https://html.spec.whatwg.org/multipage/semantics.html#the-meta-element", "test_expansion": [ { // same-insecure "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "default", "redirection": "*", "origin": "same-http", "subresource": "*", "expectation": "stripped-referrer" }, { // same-insecure "expansion": "override", "source_scheme": "http", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "default", "redirection": "swap-origin", "origin": "same-http", "subresource": "*", "expectation": "origin" }, { // cross-insecure "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "default", "redirection": "*", "origin": "cross-http", "subresource": "*", "expectation": "origin" }, { // upgrade-protocol "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "default", "redirection": "*", "origin": [ "same-https", "cross-https" ], "subresource": "*", "expectation": "origin" }, { // downgrade-protocol "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "default", "redirection": "*", "origin": [ "same-http", "cross-http" ], "subresource": "*", "expectation": "omitted" }, { // same-secure "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "default", "redirection": "*", "origin": "same-https", "subresource": "*", "expectation": "stripped-referrer" }, { // same-secure "expansion": "override", "source_scheme": "https", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "default", "redirection": "swap-origin", "origin": "same-https", "subresource": "*", "expectation": "origin" }, { // cross-secure "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "default", "redirection": "*", "origin": "cross-https", "subresource": "*", "expectation": "origin" } ] }, { // no-referrer "title": "Referrer Policy is set to 'no-referrer'", "description": "Check that sub-resource never gets the referrer URL.", "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-no-referrer", "test_expansion": [ { // generic "expansion": "default", "source_scheme": "*", "source_context_list": "*", "delivery_type": "*", "delivery_value": "no-referrer", "redirection": "*", "origin": "*", "subresource": "*", "expectation": "omitted" } ] }, { // meta tag never "title": " is set to the legacy value 'never'", "description": "Check that the legacy value 'never' is equivalent to the 'no-referrer' policy", "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-no-referrer", "test_expansion": [ { // generic "expansion": "default", "source_scheme": "*", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "never", "redirection": "*", "origin": "*", "subresource": "*", "expectation": "omitted" } ] }, { // no-referrer-when-downgrade "title": "Referrer Policy is set to 'no-referrer-when-downgrade'", "description": "Check that non a priori insecure subresource gets the full Referrer URL. A priori insecure subresource gets no referrer information.", "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-no-referrer-when-downgrade", "test_expansion": [ { // insecure-protocol "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": "no-referrer-when-downgrade", "redirection": "*", "origin": [ "same-http", "cross-http" ], "subresource": "*", "expectation": "stripped-referrer" }, { // upgrade-protocol "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": "no-referrer-when-downgrade", "redirection": "*", "origin": [ "same-https", "cross-https" ], "subresource": "*", "expectation": "stripped-referrer" }, { // downgrade-protocol "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": "no-referrer-when-downgrade", "redirection": "*", "origin": [ "same-http", "cross-http" ], "subresource": "*", "expectation": "omitted" }, { // secure-protocol "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": "no-referrer-when-downgrade", "redirection": "*", "origin": [ "same-https", "cross-https" ], "subresource": "*", "expectation": "stripped-referrer" } ] }, { // origin "title": "Referrer Policy is set to 'origin'", "description": "Check that all subresources in all casses get only the origin portion of the referrer URL.", "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-origin", "test_expansion": [ { // generic "expansion": "default", "source_scheme": "*", "source_context_list": "*", "delivery_type": "*", "delivery_value": "origin", "redirection": "*", "origin": "*", "subresource": "*", "expectation": "origin" } ] }, { // same-origin "title": "Referrer Policy is set to 'same-origin'", "description": "Check that cross-origin subresources get no referrer information and same-origin get the stripped referrer URL.", "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-same-origin", "test_expansion": [ { // same-origin-insecure "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": "same-origin", "redirection": "*", "origin": "same-http", "subresource": "*", "expectation": "stripped-referrer" }, { // same-origin-secure-default "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": "same-origin", "redirection": "*", "origin": "same-https", "subresource": "*", "expectation": "stripped-referrer" }, { // same-origin-insecure "expansion": "override", "source_scheme": "*", "source_context_list": "*", "delivery_type": "*", "delivery_value": "same-origin", "redirection": "swap-origin", "origin": [ "same-http", "same-https" ], "subresource": "*", "expectation": "omitted" }, { // cross-origin "expansion": "default", "source_scheme": "*", "source_context_list": "*", "delivery_type": "*", "delivery_value": "same-origin", "redirection": "*", "origin": [ "cross-http", "cross-https" ], "subresource": "*", "expectation": "omitted" } ] }, { // origin-when-cross-origin "title": "Referrer Policy is set to 'origin-when-cross-origin'", "description": "Check that cross-origin subresources get the origin portion of the referrer URL and same-origin get the stripped referrer URL.", "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-origin-when-cross-origin", "test_expansion": [ { // same-origin-insecure "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": "origin-when-cross-origin", "redirection": "*", "origin": "same-http", "subresource": "*", "expectation": "stripped-referrer" }, { // same-origin-secure-default "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": "origin-when-cross-origin", "redirection": "*", "origin": "same-https", "subresource": "*", "expectation": "stripped-referrer" }, { // same-origin-upgrade "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": "origin-when-cross-origin", "redirection": "*", "origin": "same-https", "subresource": "*", "expectation": "origin" }, { // same-origin-downgrade "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": "origin-when-cross-origin", "redirection": "*", "origin": "same-http", "subresource": "*", "expectation": "origin" }, { // same-origin-insecure "expansion": "override", "source_scheme": "*", "source_context_list": "*", "delivery_type": "*", "delivery_value": "origin-when-cross-origin", "redirection": "swap-origin", "origin": [ "same-http", "same-https" ], "subresource": "*", "expectation": "origin" }, { // cross-origin "expansion": "default", "source_scheme": "*", "source_context_list": "*", "delivery_type": "*", "delivery_value": "origin-when-cross-origin", "redirection": "*", "origin": [ "cross-http", "cross-https" ], "subresource": "*", "expectation": "origin" } ] }, { // meta tag origin-when-crossorigin "title": " is set to the legacy value 'origin-when-crossorigin'", "description": "Check that the legacy value 'origin-when-crossorigin' is equivalent to the 'origin-when-cross-origin' policy", "specification_url": "https://html.spec.whatwg.org/multipage/semantics.html#the-meta-element", "test_expansion": [ { // same-origin-insecure "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "origin-when-crossorigin", "redirection": "*", "origin": "same-http", "subresource": "*", "expectation": "stripped-referrer" }, { // same-origin-secure-default "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "origin-when-crossorigin", "redirection": "*", "origin": "same-https", "subresource": "*", "expectation": "stripped-referrer" }, { // same-origin-upgrade "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "origin-when-crossorigin", "redirection": "*", "origin": "same-https", "subresource": "*", "expectation": "origin" }, { // same-origin-downgrade "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "origin-when-crossorigin", "redirection": "*", "origin": "same-http", "subresource": "*", "expectation": "origin" }, { // same-origin-insecure "expansion": "override", "source_scheme": "*", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "origin-when-crossorigin", "redirection": "swap-origin", "origin": [ "same-http", "same-https" ], "subresource": "*", "expectation": "origin" }, { // cross-origin "expansion": "default", "source_scheme": "*", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "origin-when-crossorigin", "redirection": "*", "origin": [ "cross-http", "cross-https" ], "subresource": "*", "expectation": "origin" } ] }, { // strict-origin "title": "Referrer Policy is set to 'strict-origin'", "description": "Check that non a priori insecure subresource gets only the origin portion of the referrer URL. A priori insecure subresource gets no referrer information.", "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-strict-origin", "test_expansion": [ { // insecure-protocol "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": "strict-origin", "redirection": "*", "origin": [ "same-http", "cross-http" ], "subresource": "*", "expectation": "origin" }, { // upgrade-protocol "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": "strict-origin", "redirection": "*", "origin": [ "same-https", "cross-https" ], "subresource": "*", "expectation": "origin" }, { // downgrade-protocol "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": "strict-origin", "redirection": "*", "origin": [ "same-http", "cross-http" ], "subresource": "*", "expectation": "omitted" }, { // secure-protocol "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": "strict-origin", "redirection": "*", "origin": [ "same-https", "cross-https" ], "subresource": "*", "expectation": "origin" } ] }, { // strict-origin-when-cross-origin "title": "Referrer Policy is set to 'strict-origin-when-cross-origin'", "description": "Check that a priori insecure subresource gets no referrer information. Otherwise, cross-origin subresources get the origin portion of the referrer URL and same-origin get the stripped referrer URL.", "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-strict-origin-when-cross-origin", "test_expansion": [ { // same-insecure "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": "strict-origin-when-cross-origin", "redirection": "*", "origin": "same-http", "subresource": "*", "expectation": "stripped-referrer" }, { // same-insecure "expansion": "override", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": "strict-origin-when-cross-origin", "redirection": "swap-origin", "origin": "same-http", "subresource": "*", "expectation": "origin" }, { // cross-insecure "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": "strict-origin-when-cross-origin", "redirection": "*", "origin": "cross-http", "subresource": "*", "expectation": "origin" }, { // upgrade-protocol "expansion": "default", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": "strict-origin-when-cross-origin", "redirection": "*", "origin": [ "same-https", "cross-https" ], "subresource": "*", "expectation": "origin" }, { // downgrade-protocol "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": "strict-origin-when-cross-origin", "redirection": "*", "origin": [ "same-http", "cross-http" ], "subresource": "*", "expectation": "omitted" }, { // same-secure "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": "strict-origin-when-cross-origin", "redirection": "*", "origin": "same-https", "subresource": "*", "expectation": "stripped-referrer" }, { // same-secure "expansion": "override", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": "strict-origin-when-cross-origin", "redirection": "swap-origin", "origin": "same-https", "subresource": "*", "expectation": "origin" }, { // cross-secure "expansion": "default", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": "strict-origin-when-cross-origin", "redirection": "*", "origin": "cross-https", "subresource": "*", "expectation": "origin" } ] }, { // unsafe-url "title": "Referrer Policy is set to 'unsafe-url'", "description": "Check that all sub-resources get the stripped referrer URL.", "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-unsafe-url", "test_expansion": [ { // generic "expansion": "default", "source_scheme": "*", "source_context_list": "*", "delivery_type": "*", "delivery_value": "unsafe-url", "redirection": "*", "origin": "*", "subresource": "*", "expectation": "stripped-referrer" } ] }, { // meta tag always "title": " is set to the legacy value 'always'", "description": "Check that the legacy value 'always' is equivalent to the 'unsafe-url' policy", "specification_url": "https://html.spec.whatwg.org/multipage/semantics.html#the-meta-element", "test_expansion": [ { // generic "expansion": "default", "source_scheme": "*", "source_context_list": "*", "delivery_type": "meta", "delivery_value": "always", "redirection": "*", "origin": "*", "subresource": "*", "expectation": "stripped-referrer" } ] } ], "delivery_key": "referrerPolicy", "excluded_tests": [ { // upgraded-protocol-workers "expansion": "*", "source_scheme": "http", "source_context_list": "*", "delivery_type": "*", "delivery_value": "*", "redirection": "*", "origin": [ "same-https", "cross-https" ], "subresource": [ "worker-classic", "worker-module", "sharedworker-classic", "sharedworker-module" ], "expectation": "*" }, { // mixed-content-insecure-subresources "expansion": "*", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": "*", "redirection": "*", "origin": [ "same-http", "same-http-downgrade", "cross-http", "cross-http-downgrade", "same-ws", "same-ws-downgrade", "cross-ws", "cross-ws-downgrade" ], "subresource": "*", "expectation": "*" }, { // overhead-for-redirection "expansion": "*", "source_scheme": "*", "source_context_list": "*", "delivery_type": "*", "delivery_value": "*", "redirection": [ "keep-origin", "swap-origin" ], "origin": "*", "subresource": [ "a-tag", "area-tag" ], "expectation": "*" }, { // source-https-unsupported-by-web-platform-tests-runners "expansion": "*", "source_scheme": "https", "source_context_list": "*", "delivery_type": "*", "delivery_value": "*", "redirection": "*", "origin": "*", "subresource": "*", "expectation": "*" }, { // 's delivery_value should be no-referrer "expansion": "*", "source_scheme": "*", "source_context_list": "*", "delivery_type": "rel-noref", "delivery_value": [ null, "no-referrer-when-downgrade", "same-origin", "origin", "origin-when-cross-origin", "strict-origin", "strict-origin-when-cross-origin", "unsafe-url" ], "redirection": "*", "origin": "*", "subresource": "*", "expectation": "*" }, { // redirections that referrer-policy tests don't care "expansion": "*", "source_scheme": "*", "source_context_list": "*", "delivery_type": "*", "delivery_value": "*", "redirection": [ "keep-scheme", "swap-scheme", "downgrade" ], "origin": "*", "subresource": "*", "expectation": "*" }, { // origins that referrer-policy tests don't care "expansion": "*", "source_scheme": "*", "source_context_list": "*", "delivery_type": "*", "delivery_value": "*", "redirection": "*", "origin": [ "same-http-downgrade", "cross-http-downgrade", "same-ws-downgrade", "cross-ws-downgrade" ], "subresource": "*", "expectation": "*" }, { // subresource values not yet tested "expansion": "*", "source_scheme": "*", "source_context_list": "*", "delivery_type": "*", "delivery_value": "*", "redirection": "*", "subresource": [ "area-tag", "audio-tag", "beacon", "link-css-tag", "link-prefetch-tag", "object-tag", "picture-tag", "sharedworker-import", "sharedworker-import-data", "video-tag", "websocket", "worker-import", "worker-import-data", "worklet-animation", "worklet-animation-import-data", "worklet-audio", "worklet-audio-import-data", "worklet-layout", "worklet-layout-import-data", "worklet-paint", "worklet-paint-import-data" ], "origin": "*", "expectation": "*" }, { // source_context_list values not yet tested "expansion": "*", "source_scheme": "*", "source_context_list": [ "iframe-blank-inherit", "sharedworker-classic", "sharedworker-classic-data", "sharedworker-module", "sharedworker-module-data", "worker-classic-data", "worker-module-data" ], "delivery_type": "*", "delivery_value": "*", "redirection": "*", "subresource": "*", "origin": "*", "expectation": "*" }, // Skip some nested source_context_lists for faster tests. { "expansion": "*", "source_scheme": "*", "source_context_list": [ "iframe", "srcdoc", "srcdoc-inherit" ], "delivery_type": "*", "delivery_value": "*", "redirection": "*", "subresource": "script-tag-dynamic-import", "origin": "*", "expectation": "*" }, ], "source_context_schema": { "supported_delivery_type": { "top": [ "meta", "http-rp" ], "iframe": [ "meta", "http-rp" ], "iframe-blank": [ "meta" ], "srcdoc": [ "meta" ], "worker-classic": [ "http-rp" ], "worker-module": [ "http-rp" ], "worker-classic-data": [], "worker-module-data": [], "sharedworker-classic": [ "http-rp" ], "sharedworker-module": [ "http-rp" ], "sharedworker-classic-data": [], "sharedworker-module-data": [] } }, "subresource_schema": { "supported_delivery_type": { // List of elements that support "attr" delivery type can be followed // from the cross reference of: // https://html.spec.whatwg.org/C/#referrer-policy-attribute "a-tag": [ "attr", "rel-noref" ], "area-tag": [ "attr" ], "audio-tag": [], "beacon": [], // Fetch API supports `init["referrerPolicy"]` in `Request`: // https://fetch.spec.whatwg.org/#dom-request. // TODO(https://github.com/web-platform-tests/wpt/issues/21815): // Add support for this. Currently `common.sub.js` doesn't support this. "fetch": [], "iframe-tag": [ "attr" ], "img-tag": [ "attr" ], // TODO(https://github.com/web-platform-tests/wpt/issues/21815): // Support "attr" in the following ``-related subresources. // The current referrrer-policy test helper doesn't support // checking referrer results via elements. "link-css-tag": [], "link-prefetch-tag": [], "object-tag": [], // `` supports referrerpolicy attribute, // so `` inside `` also supports the attribute. // TODO(https://github.com/web-platform-tests/wpt/issues/21815): // Support this. "picture-tag": [], "script-tag": [ "attr" ], "script-tag-dynamic-import": [ // The policy set to the