commit | f6b79c618491a6e4076c8b87f13e0c8afe74f8b0 | [log] [tgz] |
---|---|---|
author | Ari Chivukula <arichiv@chromium.org> | Tue Feb 13 18:42:09 2024 |
committer | Blink WPT Bot <blink-w3c-test-autoroller@chromium.org> | Tue Feb 13 19:11:14 2024 |
tree | 323483486867c2fec34647cdee737863c4dff4b6 | |
parent | 4ee1931a4a7993cf089ebfe83a2548f0aea2b876 [diff] |
[SAA] Implementing SharedWorker support (Part 3: Implement same-site cookie filtering) TL;DR: This is a large CL, see an outline of key points under the intro. Introduction: The Storage Access API provides access to unpartitioned cookies in third-party contexts. This CL is part of a series to extend that access to SharedWorkers. Before we actually provide access to SharedWorkers, we need a way for the renderer to limit the scope of SameSite cookies provided to the worker. Normally, a worker with a first-party storage key could access all cookies, but if access is via the SAA handle we want to limit that access to just SameSite: None cookies. This CL is part of a series to allow that limiting ability. It implements the filter that prevents the inclusion of SameSite=Strict/Lax cookies in a first-party shared worker when 'sameSiteCookies': 'none' is set. Note: The ability to request 'all' in a third-party context is not added here nor will it be added. Outline: (1) require_cross_site_request_for_cookies is calculated by checking if the storage key is third-party or the sameSiteCookies option is none. (2) This is calculated in three spots: (2a) content/browser/devtools/shared_worker_devtools_agent_host.cc (2b) content/browser/worker_host/shared_worker_host.cc (2c) content/browser/worker_host/shared_worker_service_impl.cc (3) Most of the CL is propagating this boolean value down to the four key spots it's used: (3a) services/network/cors/cors_url_loader_factory.cc verifies that if the value is set, SiteForCookies is empty on the request. (3b) content/browser/worker_host/shared_worker_service_impl.cc sets the SiteForCookies used to load the script to empty. (3c) content/renderer/worker/embedded_shared_worker_stub.cc ensures that that on redirect we maintain the correct site for cookies. (3d) third_party/blink/renderer/core/fetch/fetch_manager.cc sets the SiteForCookies used to load worker fetches to empty. (4) The WPTs verify only the proper cookies can be get/set in each context, including worker load, worker fetch, and on redirect. Design Doc: https://docs.google.com/document/d/19qCGb4qwOcGiNrQM3ptWvRmB4JtpaTFgFVlWLXNOQ6c/edit Explainer: https://privacycg.github.io/saa-non-cookie-storage/shared-workers.html Part 1: Expose same-site cookie IPC Part 2: Expose same-site cookie IDL Part 3: Implement same-site cookie filtering Part 4: Add SharedWorker support to SAA handle Bug: 1484966 Change-Id: I9a6acfb94c099020683c860cb625be2519c2f384 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5269461 Reviewed-by: Daniel Cheng <dcheng@chromium.org> Commit-Queue: Ari Chivukula <arichiv@chromium.org> Auto-Submit: Ari Chivukula <arichiv@chromium.org> Cr-Commit-Position: refs/heads/main@{#1259922}
The web-platform-tests Project is a cross-browser test suite for the Web-platform stack. Writing tests in a way that allows them to be run in all browsers gives browser projects confidence that they are shipping software that is compatible with other implementations, and that later implementations will be compatible with their implementations. This in turn gives Web authors/developers confidence that they can actually rely on the Web platform to deliver on the promise of working across browsers and devices without needing extra layers of abstraction to paper over the gaps left by specification editors and implementors.
The most important sources of information and activity are:
wpt:matrix.org
matrix channel; includes participants located around the world, but busiest during the European working day.If you'd like clarification about anything, don't hesitate to ask in the chat room or on the mailing list.
Clone or otherwise get https://github.com/web-platform-tests/wpt.
Note: because of the frequent creation and deletion of branches in this repo, it is recommended to “prune” stale branches when fetching updates, i.e. use git pull --prune
(or git fetch -p && git merge
).
See the documentation website and in particular the system setup for running tests locally.
The wpt
command provides a frontend to a variety of tools for working with and running web-platform-tests. Some of the most useful commands are:
wpt serve
- For starting the wpt http serverwpt run
- For running tests in a browserwpt lint
- For running the lint against all testswpt manifest
- For updating or generating a MANIFEST.json
test manifestwpt install
- For installing the latest release of a browser or webdriver server on the local machine.wpt serve-wave
- For starting the wpt http server and the WAVE test runner. For more details on how to use the WAVE test runner see the documentation.On Windows wpt
commands must be prefixed with python
or the path to the python binary (if python
is not in your %PATH%
).
python wpt [command]
Alternatively, you may also use Bash on Ubuntu on Windows in the Windows 10 Anniversary Update build, then access your windows partition from there to launch wpt
commands.
Please make sure git and your text editor do not automatically convert line endings, as it will cause lint errors. For git, please set git config core.autocrlf false
in your working tree.
The master branch is automatically synced to wpt.live and w3c-test.org.
Save the Web, Write Some Tests!
Absolutely everyone is welcome to contribute to test development. No test is too small or too simple, especially if it corresponds to something for which you've noted an interoperability bug in a browser.
The way to contribute is just as usual:
git checkout -b topic
../wpt lint
as described above.If you spot an issue with a test and are not comfortable providing a pull request per above to fix it, please file a new issue. Thank you!