From 43a97878ce14b72f0981164f87f2e35e14151312 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Sun, 7 Apr 2024 11:22:09 +0200
Subject: Adding upstream version 110.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 .../cookies/prefix/__host.document-cookie.html     | 57 +++++++++++++++
 .../prefix/__host.document-cookie.https.html       | 74 +++++++++++++++++++
 .../tests/cookies/prefix/__host.header.html        | 83 ++++++++++++++++++++++
 .../tests/cookies/prefix/__host.header.https.html  | 83 ++++++++++++++++++++++
 .../cookies/prefix/__secure.document-cookie.html   | 41 +++++++++++
 .../prefix/__secure.document-cookie.https.html     | 41 +++++++++++
 .../tests/cookies/prefix/__secure.header.html      | 41 +++++++++++
 .../cookies/prefix/__secure.header.https.html      | 79 ++++++++++++++++++++
 .../cookies/prefix/document-cookie.non-secure.html | 42 +++++++++++
 9 files changed, 541 insertions(+)
 create mode 100644 testing/web-platform/tests/cookies/prefix/__host.document-cookie.html
 create mode 100644 testing/web-platform/tests/cookies/prefix/__host.document-cookie.https.html
 create mode 100644 testing/web-platform/tests/cookies/prefix/__host.header.html
 create mode 100644 testing/web-platform/tests/cookies/prefix/__host.header.https.html
 create mode 100644 testing/web-platform/tests/cookies/prefix/__secure.document-cookie.html
 create mode 100644 testing/web-platform/tests/cookies/prefix/__secure.document-cookie.https.html
 create mode 100644 testing/web-platform/tests/cookies/prefix/__secure.header.html
 create mode 100644 testing/web-platform/tests/cookies/prefix/__secure.header.https.html
 create mode 100644 testing/web-platform/tests/cookies/prefix/document-cookie.non-secure.html

(limited to 'testing/web-platform/tests/cookies/prefix')
diff --git a/testing/web-platform/tests/cookies/prefix/__host.document-cookie.html b/testing/web-platform/tests/cookies/prefix/__host.document-cookie.html
new file mode 100644
index 0000000000..2aeb0901f6
--- /dev/null
+++ b/testing/web-platform/tests/cookies/prefix/__host.document-cookie.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<script>
+  ["", "domain="+document.location.hostname, "MaxAge=10", "HttpOnly"].forEach(extraParams => {
+    // Without 'secure'
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__Host-",
+      params: "Path=/;" + extraParams,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__Host: Non-secure origin: 'Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__HoSt-",
+      params: "Path=/;" + extraParams,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__HoSt: Non-secure origin: 'Path=/;" + extraParams + "'"
+    });
+
+    // With 'secure'
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__Host-",
+      params: "Secure; Path=/;" + extraParams,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__Host: Non-secure origin: 'Secure; Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__HoSt-",
+      params: "Secure; Path=/;" + extraParams,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__HoSt: Non-secure origin: 'Secure; Path=/;" + extraParams + "'"
+    });
+  });
+
+  set_prefixed_cookie_via_dom_test({
+    prefix: "__Host-",
+    params: "Secure; Path=/cookies/resources/list.py",
+    shouldExistInDOM: false,
+    shouldExistViaHTTP: false,
+    title: "__Host: Non-secure origin: 'Secure; Path=/cookies/resources/list.py'"
+  });
+
+  set_prefixed_cookie_via_dom_test({
+    prefix: "__HoSt-",
+    params: "Secure; Path=/cookies/resources/list.py",
+    shouldExistInDOM: false,
+    shouldExistViaHTTP: false,
+    title: "__HoSt: Non-secure origin: 'Secure; Path=/cookies/resources/list.py'"
+  });
+</script>
diff --git a/testing/web-platform/tests/cookies/prefix/__host.document-cookie.https.html b/testing/web-platform/tests/cookies/prefix/__host.document-cookie.https.html
new file mode 100644
index 0000000000..cc0cb34ecb
--- /dev/null
+++ b/testing/web-platform/tests/cookies/prefix/__host.document-cookie.https.html
@@ -0,0 +1,74 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<script>
+  ["", "MaxAge=10"].forEach(extraParams => {
+    // Without 'secure'
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__Host-",
+      params: "Path=/;" + extraParams,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__Host: Secure origin: Does not set 'Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__HoSt-",
+      params: "Path=/;" + extraParams,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__HoSt: Secure origin: Does not set 'Path=/;" + extraParams + "'"
+    });
+
+    // With 'secure'
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__Host-",
+      params: "Secure; Path=/;" + extraParams,
+      shouldExistInDOM: true,
+      shouldExistViaHTTP: true,
+      title: "__Host: Secure origin: Does set 'Secure; Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__HoSt-",
+      params: "Secure; Path=/;" + extraParams,
+      shouldExistInDOM: true,
+      shouldExistViaHTTP: true,
+      title: "__HoSt: Secure origin: Does set 'Secure; Path=/;" + extraParams + "'"
+    });
+
+    // With 'domain'
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__Host-",
+      params: "Secure; Path=/; Domain=" + document.location.hostname + "; " + extraParams,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__Host: Secure origin: Does not set 'Secure; Path=/; Domain=" + document.location.hostname + "; " + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__HoSt-",
+      params: "Secure; Path=/; Domain=" + document.location.hostname + "; " + extraParams,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__HoSt: Secure origin: Does not set 'Secure; Path=/; Domain=" + document.location.hostname + "; " + extraParams + "'"
+    });
+  });
+
+  set_prefixed_cookie_via_dom_test({
+    prefix: "__Host-",
+    params: "Secure; Path=/cookies/resources/list.py",
+    shouldExistInDOM: false,
+    shouldExistViaHTTP: false,
+    title: "__Host: Secure origin: Does not set 'Secure; Path=/cookies/resources/list.py'"
+  });
+
+  set_prefixed_cookie_via_dom_test({
+    prefix: "__HoSt-",
+    params: "Secure; Path=/cookies/resources/list.py",
+    shouldExistInDOM: false,
+    shouldExistViaHTTP: false,
+    title: "__HoSt: Secure origin: Does not set 'Secure; Path=/cookies/resources/list.py'"
+  });
+</script>
diff --git a/testing/web-platform/tests/cookies/prefix/__host.header.html b/testing/web-platform/tests/cookies/prefix/__host.header.html
new file mode 100644
index 0000000000..7ad6782584
--- /dev/null
+++ b/testing/web-platform/tests/cookies/prefix/__host.header.html
@@ -0,0 +1,83 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<script>
+  ["", "domain="+document.location.hostname, "MaxAge=10", "HttpOnly"].forEach(extraParams => {
+    // Without 'secure'
+    set_prefixed_cookie_via_http_test({
+      prefix: "__Host-",
+      params: "Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__Host: Non-secure origin: Does not set 'Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_http_test({
+      prefix: "__HoSt-",
+      params: "Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__HoSt: Non-secure origin: Does not set 'Path=/;" + extraParams + "'"
+    });
+
+    // With 'secure'
+    set_prefixed_cookie_via_http_test({
+      prefix: "__Host-",
+      params: "Secure; Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__Host: Non-secure origin: Does not set 'Secure; Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_http_test({
+      prefix: "__HoSt-",
+      params: "Secure; Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__HoSt: Non-secure origin: Does not set 'Secure; Path=/;" + extraParams + "'"
+    });
+
+    // With 'domain'
+    set_prefixed_cookie_via_http_test({
+      prefix: "__Host-",
+      params: "Secure; Path=/; Domain=" + document.location.hostname + "; " + extraParams,
+      origin: self.origin,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__Host: Secure origin: Does not set 'Secure; Path=/; Domain=" + document.location.hostname + "; " + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_http_test({
+      prefix: "__HoSt-",
+      params: "Secure; Path=/; Domain=" + document.location.hostname + "; " + extraParams,
+      origin: self.origin,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__HoSt: Secure origin: Does not set 'Secure; Path=/; Domain=" + document.location.hostname + "; " + extraParams + "'"
+    });
+  });
+
+  set_prefixed_cookie_via_http_test({
+    prefix: "__Host-",
+    params: "Secure; Path=/cookies/resources/list.py",
+    origin: self.origin,
+    shouldExistInDOM: false,
+    shouldExistViaHTTP: false,
+    title: "__Host: Non-secure origin: Does not set 'Secure; Path=/cookies/resources/list.py'"
+  });
+
+  set_prefixed_cookie_via_http_test({
+    prefix: "__HoSt-",
+    params: "Secure; Path=/cookies/resources/list.py",
+    origin: self.origin,
+    shouldExistInDOM: false,
+    shouldExistViaHTTP: false,
+    title: "__HoSt: Non-secure origin: Does not set 'Secure; Path=/cookies/resources/list.py'"
+  });
+</script>
+
diff --git a/testing/web-platform/tests/cookies/prefix/__host.header.https.html b/testing/web-platform/tests/cookies/prefix/__host.header.https.html
new file mode 100644
index 0000000000..b7f1365276
--- /dev/null
+++ b/testing/web-platform/tests/cookies/prefix/__host.header.https.html
@@ -0,0 +1,83 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<script>
+  ["", "MaxAge=10", "HttpOnly"].forEach(extraParams => {
+    // Without 'secure'
+    set_prefixed_cookie_via_http_test({
+      prefix: "__Host-",
+      params: "Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__Host: Secure origin: Does not set 'Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_http_test({
+      prefix: "__HoSt-",
+      params: "Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__HoSt: Secure origin: Does not set 'Path=/;" + extraParams + "'"
+    });
+
+    // With 'secure'
+    set_prefixed_cookie_via_http_test({
+      prefix: "__Host-",
+      params: "Secure; Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistInDOM: true,
+      shouldExistViaHTTP: true,
+      title: "__Host: Secure origin: Does set 'Secure; Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_http_test({
+      prefix: "__HoSt-",
+      params: "Secure; Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistInDOM: true,
+      shouldExistViaHTTP: true,
+      title: "__HoSt: Secure origin: Does set 'Secure; Path=/;" + extraParams + "'"
+    });
+
+    // With 'domain'
+    set_prefixed_cookie_via_http_test({
+      prefix: "__Host-",
+      params: "Secure; Path=/; Domain=" + document.location.hostname + "; " + extraParams,
+      origin: self.origin,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__Host: Secure origin: Does not set 'Secure; Path=/; Domain=" + document.location.hostname + "; " + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_http_test({
+      prefix: "__HoSt-",
+      params: "Secure; Path=/; Domain=" + document.location.hostname + "; " + extraParams,
+      origin: self.origin,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__HoSt: Secure origin: Does not set 'Secure; Path=/; Domain=" + document.location.hostname + "; " + extraParams + "'"
+    });
+  });
+
+  set_prefixed_cookie_via_http_test({
+    prefix: "__Host-",
+    params: "Secure; Path=/cookies/resources/list.py",
+    origin: self.origin,
+    shouldExistInDOM: false,
+    shouldExistViaHTTP: false,
+    title: "__Host: Secure origin: Does not set 'Secure; Path=/cookies/resources/list.py'"
+  });
+
+  set_prefixed_cookie_via_http_test({
+    prefix: "__HoSt-",
+    params: "Secure; Path=/cookies/resources/list.py",
+    origin: self.origin,
+    shouldExistInDOM: false,
+    shouldExistViaHTTP: false,
+    title: "__HoSt: Secure origin: Does not set 'Secure; Path=/cookies/resources/list.py'"
+  });
+</script>
+
diff --git a/testing/web-platform/tests/cookies/prefix/__secure.document-cookie.html b/testing/web-platform/tests/cookies/prefix/__secure.document-cookie.html
new file mode 100644
index 0000000000..2246ffff4c
--- /dev/null
+++ b/testing/web-platform/tests/cookies/prefix/__secure.document-cookie.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<script>
+  ["", "MaxAge=10", "domain="+document.location.hostname].forEach(extraParams => {
+    // Without 'secure'
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__Secure-",
+      params: "Path=/;" + extraParams,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__Secure: Non-secure origin: Should not set 'Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__SeCuRe-",
+      params: "Path=/;" + extraParams,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__SeCuRe: Non-secure origin: Should not set 'Path=/;" + extraParams + "'"
+    });
+
+    // With 'secure'
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__Secure-",
+      params: "Secure; Path=/;" + extraParams,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__Secure: Non-secure origin: Should not set 'Secure; Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__SeCuRe-",
+      params: "Secure; Path=/;" + extraParams,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__SeCuRe: Non-secure origin: Should not set 'Secure; Path=/;" + extraParams + "'"
+    });
+  });
+</script>
diff --git a/testing/web-platform/tests/cookies/prefix/__secure.document-cookie.https.html b/testing/web-platform/tests/cookies/prefix/__secure.document-cookie.https.html
new file mode 100644
index 0000000000..4b600032a8
--- /dev/null
+++ b/testing/web-platform/tests/cookies/prefix/__secure.document-cookie.https.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<script>
+  ["", "MaxAge=10", "domain="+document.location.hostname].forEach(extraParams => {
+    // Without 'secure'
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__Secure-",
+      params: "Path=/;" + extraParams,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__Secure: Secure origin: Should not set 'Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__SeCuRe-",
+      params: "Path=/;" + extraParams,
+      shouldExistInDOM: false,
+      shouldExistViaHTTP: false,
+      title: "__SeCuRe: Secure origin: Should not set 'Path=/;" + extraParams + "'"
+    });
+
+    // With 'secure'
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__Secure-",
+      params: "Secure; Path=/;" + extraParams,
+      shouldExistInDOM: true,
+      shouldExistViaHTTP: true,
+      title: "__Secure: Secure origin: Should set 'Secure; Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_dom_test({
+      prefix: "__SeCuRe-",
+      params: "Secure; Path=/;" + extraParams,
+      shouldExistInDOM: true,
+      shouldExistViaHTTP: true,
+      title: "__SeCuRe: Secure origin: Should set 'Secure; Path=/;" + extraParams + "'"
+    });
+  });
+</script>
diff --git a/testing/web-platform/tests/cookies/prefix/__secure.header.html b/testing/web-platform/tests/cookies/prefix/__secure.header.html
new file mode 100644
index 0000000000..85665afefd
--- /dev/null
+++ b/testing/web-platform/tests/cookies/prefix/__secure.header.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<script>
+  ["", "domain="+document.location.hostname, "MaxAge=10", "HttpOnly"].forEach(extraParams => {
+    // Without 'secure'
+    set_prefixed_cookie_via_http_test({
+      prefix: "__Secure-",
+      params: "Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistViaHTTP: false,
+      title: "__Secure: Non-secure origin: Should not set 'Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_http_test({
+      prefix: "__SeCuRe-",
+      params: "Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistViaHTTP: false,
+      title: "__SeCuRe: Non-secure origin: Should not set 'Path=/;" + extraParams + "'"
+    });
+
+    // With 'secure'
+    set_prefixed_cookie_via_http_test({
+      prefix: "__Secure-",
+      params: "Secure; Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistViaHTTP: false,
+      title: "__Secure: Non-secure origin: Should not set 'Secure; Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_http_test({
+      prefix: "__SeCuRe-",
+      params: "Secure; Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistViaHTTP: false,
+      title: "__SeCuRe: Non-secure origin: Should not set 'Secure; Path=/;" + extraParams + "'"
+    });
+  });
+</script>
diff --git a/testing/web-platform/tests/cookies/prefix/__secure.header.https.html b/testing/web-platform/tests/cookies/prefix/__secure.header.https.html
new file mode 100644
index 0000000000..a6fee03b0c
--- /dev/null
+++ b/testing/web-platform/tests/cookies/prefix/__secure.header.https.html
@@ -0,0 +1,79 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<script>
+  ["", "MaxAge=10", "HttpOnly"].forEach(extraParams => {
+    // Without 'secure'
+    set_prefixed_cookie_via_http_test({
+      prefix: "__Secure-",
+      params: "Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistViaHTTP: false,
+      title: "__Secure: secure origin: Should not set 'Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_http_test({
+      prefix: "__SeCuRe-",
+      params: "Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistViaHTTP: false,
+      title: "__SeCuRe: secure origin: Should not set 'Path=/;" + extraParams + "'"
+    });
+
+    // With 'secure'
+    set_prefixed_cookie_via_http_test({
+      prefix: "__Secure-",
+      params: "Secure;Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistViaHTTP: true,
+      title: "__Secure: secure origin: Should set 'Secure;Path=/;" + extraParams + "'"
+    });
+
+    set_prefixed_cookie_via_http_test({
+      prefix: "__SeCuRe-",
+      params: "Secure;Path=/;" + extraParams,
+      origin: self.origin,
+      shouldExistViaHTTP: true,
+      title: "__SeCuRe: secure origin: Should set 'Secure;Path=/;" + extraParams + "'"
+    });
+  });
+
+  // Without 'secure'
+  set_prefixed_cookie_via_http_test({
+    prefix: "__Secure-",
+    // SameSite=None is necessary because cross-site origins cannot set SameSite cookies via fetch.
+    params: "Path=/;SameSite=None;domain=" + CROSS_SITE_HOST,
+    origin: SECURE_CROSS_SITE_ORIGIN,
+    shouldExistViaHTTP: false,
+    title: "__Secure: secure origin: Should not set 'Path=/;domain=" + CROSS_SITE_HOST + "'"
+  });
+
+  set_prefixed_cookie_via_http_test({
+    prefix: "__SeCuRe-",
+    // SameSite=None is necessary because cross-site origins cannot set SameSite cookies via fetch.
+    params: "Path=/;SameSite=None;domain=" + CROSS_SITE_HOST,
+    origin: SECURE_CROSS_SITE_ORIGIN,
+    shouldExistViaHTTP: false,
+    title: "__SeCuRe: secure origin: Should not set 'Path=/;domain=" + CROSS_SITE_HOST + "'"
+  });
+
+  // With 'secure'
+  set_prefixed_cookie_via_http_test({
+    prefix: "__Secure-",
+    // SameSite=None is necessary because cross-site origins cannot set SameSite cookies via fetch.
+    params: "Secure;SameSite=None;Path=/;domain=" + CROSS_SITE_HOST,
+    origin: SECURE_CROSS_SITE_ORIGIN,
+    shouldExistViaHTTP: true,
+    title: "__Secure: secure origin: Should set 'Secure;Path=/;domain=" + CROSS_SITE_HOST + "'"
+  });
+
+  set_prefixed_cookie_via_http_test({
+    prefix: "__SeCuRe-",
+    // SameSite=None is necessary because cross-site origins cannot set SameSite cookies via fetch.
+    params: "Secure;SameSite=None;Path=/;domain=" + CROSS_SITE_HOST,
+    origin: SECURE_CROSS_SITE_ORIGIN,
+    shouldExistViaHTTP: true,
+    title: "__SeCuRe: secure origin: Should set 'Secure;Path=/;domain=" + CROSS_SITE_HOST + "'"
+  });
+</script>
diff --git a/testing/web-platform/tests/cookies/prefix/document-cookie.non-secure.html b/testing/web-platform/tests/cookies/prefix/document-cookie.non-secure.html
new file mode 100644
index 0000000000..efa16a8c5e
--- /dev/null
+++ b/testing/web-platform/tests/cookies/prefix/document-cookie.non-secure.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/cookies/resources/cookie-helper.sub.js"></script>
+<script>
+  function create_test(prefix, params, shouldExistInDOM, shouldExistViaHTTP, title) {
+    promise_test(t => {
+      var name = prefix + "prefixtestcookie";
+      erase_cookie_from_js(name, params);
+      t.add_cleanup(() => erase_cookie_from_js(name, params));
+      var value = "" + Math.random();
+      document.cookie = name + "=" + value + ";" + params;
+
+      assert_dom_cookie(name, value, shouldExistInDOM);
+
+      return credFetch("/cookies/resources/list.py")
+        .then(r => r.json())
+        .then(cookies => assert_equals(cookies[name], shouldExistViaHTTP ? value : undefined));
+    }, title);
+  }
+
+  // No prefix
+  create_test("", "path=/", true, true, "No prefix, root path, no special behavior");
+  create_test("", "path=/;domain=" + document.location.hostname, true, true, "No prefix, domain, no special behavior");
+
+  // `__Secure-` Prefix
+  ["", "domain="+document.location.hostname, "MaxAge=10", "HttpOnly"].forEach(params => {
+    create_test("__Secure-", "Path=/;" + params, false, false, "__Secure: Non-secure origin: 'Path=/;" + params + "'");
+    create_test("__SeCuRe-", "Path=/;" + params, false, false, "__SeCuRe: Non-secure origin: 'Path=/;" + params + "'");
+    create_test("__Secure-", "Secure; Path=/;" + params, false, false, "__Secure: Non-secure origin: 'Secure; Path=/;" + params + "'");
+    create_test("__SeCuRe-", "Secure; Path=/;" + params, false, false, "__SeCuRe: Non-secure origin: 'Secure; Path=/;" + params + "'");
+  });
+
+  // `__Host-` Prefix
+  ["", "domain="+document.location.hostname, "MaxAge=10", "HttpOnly"].forEach(params => {
+    create_test("__Host-", "Path=/;" + params, false, false, "__Host: Non-secure origin: 'Path=/; " + params + "'");
+    create_test("__HoSt-", "Path=/;" + params, false, false, "__HoSt: Non-secure origin: 'Path=/; " + params + "'");
+    create_test("__Host-", "Secure; Path=/;" + params, false, false, "__Host: Non-secure origin: 'Secure; Path=/; " + params + "'");
+    create_test("__HoSt-", "Secure; Path=/;" + params, false, false, "__HoSt: Non-secure origin: 'Secure; Path=/; " + params + "'");
+  });
+  create_test("__Secure-", "Path=/cookies/resources/list.py;Secure", false, false, "__Host: Non-secure origin: 'Path=/cookies/resources/list.py;Secure'");
+</script>
-- 
cgit v1.2.3

