| <!DOCTYPE html> |
| <script src=/resources/testharness.js></script> |
| <script src=/resources/testharnessreport.js></script> |
| <script src=/common/security-features/resources/common.js></script> |
| <script src=/fetch/sec-metadata/resources/helper.js></script> |
| <body> |
| <script> |
| // These tests reuse the `referrer-policy` infrastructure to load images that |
| // encode their request headers in their pixels. Fun stuff! |
| promise_test(() => |
| loadImageInWindow( |
| "https://{{host}}:{{ports[https][0]}}/referrer-policy/generic/subresource/image.py", |
| [], |
| window) |
| .then(img => { |
| headers = decodeImageData(extractImageData(img)).headers; |
| got = { |
| "dest": headers["sec-fetch-dest"], |
| "mode": headers["sec-fetch-mode"], |
| "site": headers["sec-fetch-site"], |
| "user": headers["sec-fetch-user"] |
| }; |
| assert_header_equals(got, { |
| "dest": "image", |
| "site": "same-origin", |
| "user": "?F", |
| "mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin` |
| }); |
| }), |
| "Same-origin image"); |
| |
| promise_test(() => |
| loadImageInWindow( |
| "https://{{hosts[][www]}}:{{ports[https][0]}}/referrer-policy/generic/subresource/image.py", |
| [], |
| window) |
| .then(img => { |
| headers = decodeImageData(extractImageData(img)).headers; |
| got = { |
| "dest": headers["sec-fetch-dest"], |
| "mode": headers["sec-fetch-mode"], |
| "site": headers["sec-fetch-site"], |
| "user": headers["sec-fetch-user"] |
| }; |
| assert_header_equals(got, { |
| "dest": "image", |
| "site": "same-site", |
| "user": "?F", |
| "mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin` |
| }); |
| }), |
| "Same-site image"); |
| |
| promise_test(() => |
| loadImageInWindow( |
| "https://{{hosts[alt][www]}}:{{ports[https][0]}}/referrer-policy/generic/subresource/image.py", |
| [], |
| window) |
| .then(img => { |
| headers = decodeImageData(extractImageData(img)).headers; |
| got = { |
| "dest": headers["sec-fetch-dest"], |
| "mode": headers["sec-fetch-mode"], |
| "site": headers["sec-fetch-site"], |
| "user": headers["sec-fetch-user"] |
| }; |
| assert_header_equals(got, { |
| "dest": "image", |
| "site": "cross-site", |
| "user": "?F", |
| "mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin` |
| }); |
| }), |
| "Cross-site image"); |
| </script> |
