Add WPT for cross-site requests with credentials omitted

Daniel Rubery · chromium-wpt-export-bot · commit d803d63619de · 2025-03-27T14:37:01.000-07:00
I initially thought this would trigger refreshes since we don't check credentials mode in Session::ShouldDeferRequest. It turns out there's an implicit dependency since the caller of SessionService::ShouldDefer is UrlRequestHttpJob::SetCookieHeaderAndStart, which is only called when credentials mode allows credentials. It seems worth testing that behavior, since it's an important primitive for mitigating cross-site leaks. Change-Id: Id7738597eaeb966167a4d8d71f69798648d684c2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6394915 Reviewed-by: thefrog <thefrog@chromium.org> Commit-Queue: Daniel Rubery <drubery@chromium.org> Cr-Commit-Position: refs/heads/main@{#1438968}
diff --git a/device-bound-session-credentials/fetch-no-credentials.https.html b/device-bound-session-credentials/fetch-no-credentials.https.html
@@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>DBSC does not refresh cross-site fetch without credentials</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="helper.js" type="module"></script>
+
+<script type="module">
+  import { documentHasCookie, expireCookie, waitForCookie, addCookieAndSessionCleanup, setupShardedServerState, configureServer } from "./helper.js";
+
+  promise_test(async t => {
+    const testId = await setupShardedServerState();
+    const expectedCookieAndValue = "auth_cookie=abcdef0123";
+    const expectedCookieAndAttributes = `${expectedCookieAndValue};Domain=${location.hostname};Path=/device-bound-session-credentials`;
+    addCookieAndSessionCleanup(t);
+
+    // Prompt starting a session, and wait until registration completes.
+    const loginResponse = await fetch('login.py');
+    assert_equals(loginResponse.status, 200);
+    await waitForCookie(expectedCookieAndValue, /*expectCookie=*/true);
+
+    // Expire the cookies
+    expireCookie(expectedCookieAndAttributes);
+
+    // Setup for receiving messages
+    let messageCallbacks = [];
+    function messageListener(event) {
+      if (messageCallbacks.length > 0) {
+          messageCallbacks[0](event.data);
+          messageCallbacks.shift();
+      }
+    };
+    window.addEventListener("message", messageListener);
+    t.add_cleanup(() => {
+      window.removeEventListener("message", messageListener);
+    });
+
+    function getMessage() {
+        return new Promise((resolve, reject) => {
+            messageCallbacks.push(resolve);
+        });
+    }
+
+    // Create a cross-site iframe that's going to try to fetch without credentials
+    let iframe = document.createElement('iframe');
+    iframe.src = `${get_host_info().HTTPS_NOTSAMESITE_ORIGIN}/device-bound-session-credentials/fetch-verify-authenticated.https.html`;
+    document.body.appendChild(iframe);
+
+    let statusCode = await getMessage();
+    assert_equals(statusCode, 401);
+
+    // We should not have refreshed.
+    assert_false(documentHasCookie(expectedCookieAndValue));
+  }, "A cross-site fetch without credentials should not refresh");
+</script>
diff --git a/device-bound-session-credentials/fetch-verify-authenticated.https.html b/device-bound-session-credentials/fetch-verify-authenticated.https.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<script src="/common/get-host-info.sub.js"></script>
+<body>
+  <script>
+    async function onload() {
+      let base_origin = get_host_info().ORIGIN;
+      let response = await fetch(`${base_origin}/device-bound-session-credentials/verify_authenticated.py`, {credentials: "omit"});
+      window.parent.postMessage(response.status, base_origin);
+    }
+    onload();
+  </script>
+</body>
