Skip to content

Commit 3b3a521

Browse files
Yoav Weisschromium-wpt-export-bot
Yoav Weiss
authored and
chromium-wpt-export-bot
committed
__HostHttp- cookie prefix
Similar to [1], this adds an __HostHttp- prefix that ensures that a cookies is both Host-scoped and httpOnly. Specified in [2] [1] https://chromium-review.googlesource.com/c/chromium/src/+/6638647 [2] httpwg/http-extensions#3110 Bug: 426096760 Change-Id: Id1637331eaa3035443d005450c022b326378aeed Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6650996 Commit-Queue: Yoav Weiss (@Shopify) <[email protected]> Reviewed-by: Maks Orlovich <[email protected]> Reviewed-by: Chris Fredrickson <[email protected]> Reviewed-by: Dylan Cutler <[email protected]> Cr-Commit-Position: refs/heads/main@{#1478697}
1 parent 9dbcb7d commit 3b3a521

File tree

2 files changed

+64
-1
lines changed

2 files changed

+64
-1
lines changed

‎cookie-store/cookieStore_special_names.https.any.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@
5454
}, `cookieStore.set with ${prefix} prefix a path option`);
5555
});
5656

57-
['__Http-', '__http-'].forEach(prefix => {
57+
['__HostHttp-', '__hosthttp-', '__Http-', '__http-'].forEach(prefix => {
5858
promise_test(async testCase => {
5959
await promise_rejects_js(testCase, TypeError,
6060
cookieStore.set({ name: `${prefix}cookie-name`, value: 'cookie-value'}));

‎cookies/prefix/__HostHttp.https.tentative.html

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="/cookies/resources/cookie-helper.sub.js"></script>
5+
<script>
6+
set_prefixed_cookie_via_dom_test({
7+
prefix: "__HostHttp-",
8+
params: "Secure; Path=/",
9+
shouldExistInDOM: false,
10+
shouldExistViaHTTP: false,
11+
title: "__HostHttp: Does not set via DOM 'Secure; Path=/'"
12+
});
13+
14+
set_prefixed_cookie_via_dom_test({
15+
prefix: "__HostHttp-",
16+
params: "Secure; Path=/; Domain=" + document.location.hostname,
17+
shouldExistInDOM: false,
18+
shouldExistViaHTTP: false,
19+
title: "__HostHttp: Does not set via DOM with Domain attribute 'Secure; Path=/; Domain=" +
20+
document.location.hostname + "'"
21+
});
22+
23+
set_prefixed_cookie_via_http_test({
24+
prefix: "__HostHttp-",
25+
params: "Secure; Path=/",
26+
shouldExistViaHTTP: false,
27+
origin: self.origin,
28+
title: "__HostHttp: Does not set via HTTP with 'Secure; Path=/'"
29+
});
30+
31+
set_prefixed_cookie_via_http_test({
32+
prefix: "__HostHttp-",
33+
params: "Secure; Path=/;httponly",
34+
shouldExistViaHTTP: true,
35+
origin: self.origin,
36+
title: "__HostHttp: Set via HTTP with 'Secure; Path=/; httponly'"
37+
});
38+
39+
set_prefixed_cookie_via_http_test({
40+
prefix: "__HostHttp-",
41+
params: "Secure; Path=/cookies/;httponly",
42+
shouldExistViaHTTP: false,
43+
origin: self.origin,
44+
title: "__HostHttp: Does not set via HTTP with 'Secure; Path=/cookies/; httponly'"
45+
});
46+
47+
set_prefixed_cookie_via_http_test({
48+
prefix: "__HostHttp-",
49+
params: "Path=/",
50+
shouldExistViaHTTP: false,
51+
origin: self.origin,
52+
title: "__HostHttp: Does not set via HTTP with 'Path=/;' (without Secure)"
53+
});
54+
55+
set_prefixed_cookie_via_http_test({
56+
prefix: "__HostHttp-",
57+
params: "Secure; Path=/; Domain=" + document.location.hostname,
58+
shouldExistViaHTTP: false,
59+
origin: self.origin,
60+
title: "__HostHttp: Does not set via HTTP with Domain attribute 'Secure; Path=/; Domain=" +
61+
document.location.hostname + "'"
62+
});
63+
</script>

0 commit comments

Comments
 (0)