1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
// META: script=/common/get-host-info.sub.js
// META: script=/common/utils.js
// META: script=/common/dispatcher/dispatcher.js
// META: script=/html/cross-origin-embedder-policy/credentialless/resources/common.js
// META: script=./resources/common.js
const same_origin = get_host_info().HTTPS_ORIGIN;
const cross_origin = get_host_info().HTTPS_REMOTE_ORIGIN;
const cookie_key = "credentialless_iframe_load_cookie";
const cookie_same_origin = "same_origin";
const cookie_cross_origin = "cross_origin";
const cookieFromResource = async resource_token => {
let headers = JSON.parse(await receive(resource_token));
return parseCookies(headers)[cookie_key];
};
// Load a credentialless iframe, return the HTTP request cookies.
const cookieFromCredentiallessIframeRequest = async (iframe_origin) => {
const resource_token = token();
let iframe = document.createElement("iframe");
iframe.src = `${showRequestHeaders(iframe_origin, resource_token)}`;
iframe.credentialless = true;
document.body.appendChild(iframe);
return await cookieFromResource(resource_token);
};
// Load a resource `type` from the iframe with `document_token`,
// return the HTTP request cookies.
const cookieFromResourceInIframe =
async (document_token, resource_origin, type = "img") => {
const resource_token = token();
send(document_token, `
let el = document.createElement("${type}");
el.src = "${showRequestHeaders(resource_origin, resource_token)}";
document.body.appendChild(el);
`);
return await cookieFromResource(resource_token);
};
promise_test_parallel(async test => {
await Promise.all([
setCookie(same_origin, cookie_key, cookie_same_origin),
setCookie(cross_origin, cookie_key, cookie_cross_origin),
]);
promise_test_parallel(async test => {
assert_equals(
await cookieFromCredentiallessIframeRequest(same_origin),
undefined
);
}, "Credentialless same-origin iframe is loaded without credentials");
promise_test_parallel(async test => {
assert_equals(
await cookieFromCredentiallessIframeRequest(cross_origin),
undefined
);
}, "Credentialless cross-origin iframe is loaded without credentials");
const iframe_same_origin = newIframeCredentialless(same_origin);
const iframe_cross_origin = newIframeCredentialless(cross_origin);
promise_test_parallel(async test => {
assert_equals(
await cookieFromResourceInIframe(iframe_same_origin, same_origin),
undefined
);
}, "same_origin credentialless iframe can't send same_origin credentials");
promise_test_parallel(async test => {
assert_equals(
await cookieFromResourceInIframe(iframe_same_origin, cross_origin),
undefined
);
}, "same_origin credentialless iframe can't send cross_origin credentials");
promise_test_parallel(async test => {
assert_equals(
await cookieFromResourceInIframe(iframe_cross_origin, cross_origin),
undefined
);
}, "cross_origin credentialless iframe can't send cross_origin credentials");
promise_test_parallel(async test => {
assert_equals(
await cookieFromResourceInIframe(iframe_cross_origin, same_origin),
undefined
);
}, "cross_origin credentialless iframe can't send same_origin credentials");
promise_test_parallel(async test => {
assert_equals(
await cookieFromResourceInIframe(iframe_same_origin, same_origin,
"iframe"),
undefined
);
}, "same_origin credentialless iframe can't send same_origin credentials "
+ "on child iframe");
promise_test_parallel(async test => {
assert_equals(
await cookieFromResourceInIframe(iframe_same_origin, cross_origin,
"iframe"),
undefined
);
}, "same_origin credentialless iframe can't send cross_origin credentials "
+ "on child iframe");
promise_test_parallel(async test => {
assert_equals(
await cookieFromResourceInIframe(iframe_cross_origin, cross_origin,
"iframe"),
undefined
);
}, "cross_origin credentialless iframe can't send cross_origin credentials "
+ "on child iframe");
promise_test_parallel(async test => {
assert_equals(
await cookieFromResourceInIframe(iframe_cross_origin, same_origin,
"iframe"),
undefined
);
}, "cross_origin credentialless iframe can't send same_origin credentials "
+ "on child iframe");
}, "Setup")
|
