| { |
| "specification": [ |
| { |
| "name": "unset-referrer-policy", |
| "title": "Referrer Policy is not explicitly defined", |
| "description": "Check that referrer URL follows no-referrer-when-downgrade policy when no explicit Referrer Policy is set.", |
| "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policies", |
| "test_expansion": [ |
| { |
| "name": "insecure-protocol", |
| "expansion": "default", |
| "source_scheme": "http", |
| "delivery_type": "*", |
| "delivery_value": null, |
| "redirection": "*", |
| "origin": [ |
| "same-http", |
| "cross-http" |
| ], |
| "subresource": "*", |
| "expectation": "stripped-referrer" |
| }, |
| { |
| "name": "upgrade-protocol", |
| "expansion": "default", |
| "source_scheme": "http", |
| "delivery_type": "*", |
| "delivery_value": null, |
| "redirection": "*", |
| "origin": [ |
| "same-https", |
| "cross-https" |
| ], |
| "subresource": "*", |
| "expectation": "stripped-referrer" |
| }, |
| { |
| "name": "downgrade-protocol", |
| "expansion": "default", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": null, |
| "redirection": "*", |
| "origin": [ |
| "same-http", |
| "cross-http" |
| ], |
| "subresource": "*", |
| "expectation": "omitted" |
| }, |
| { |
| "name": "secure-protocol", |
| "expansion": "default", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": null, |
| "redirection": "*", |
| "origin": [ |
| "same-https", |
| "cross-https" |
| ], |
| "subresource": "*", |
| "expectation": "stripped-referrer" |
| } |
| ] |
| }, |
| { |
| "name": "no-referrer", |
| "title": "Referrer Policy is set to 'no-referrer'", |
| "description": "Check that sub-resource never gets the referrer URL.", |
| "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-no-referrer", |
| "test_expansion": [ |
| { |
| "name": "generic", |
| "expansion": "default", |
| "source_scheme": "*", |
| "delivery_type": "*", |
| "delivery_value": "no-referrer", |
| "redirection": "*", |
| "origin": "*", |
| "subresource": "*", |
| "expectation": "omitted" |
| } |
| ] |
| }, |
| { |
| "name": "no-referrer-when-downgrade", |
| "title": "Referrer Policy is set to 'no-referrer-when-downgrade'", |
| "description": "Check that non a priori insecure subresource gets the full Referrer URL. A priori insecure subresource gets no referrer information.", |
| "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-no-referrer-when-downgrade", |
| "test_expansion": [ |
| { |
| "name": "insecure-protocol", |
| "expansion": "default", |
| "source_scheme": "http", |
| "delivery_type": "*", |
| "delivery_value": "no-referrer-when-downgrade", |
| "redirection": "*", |
| "origin": [ |
| "same-http", |
| "cross-http" |
| ], |
| "subresource": "*", |
| "expectation": "stripped-referrer" |
| }, |
| { |
| "name": "upgrade-protocol", |
| "expansion": "default", |
| "source_scheme": "http", |
| "delivery_type": "*", |
| "delivery_value": "no-referrer-when-downgrade", |
| "redirection": "*", |
| "origin": [ |
| "same-https", |
| "cross-https" |
| ], |
| "subresource": "*", |
| "expectation": "stripped-referrer" |
| }, |
| { |
| "name": "downgrade-protocol", |
| "expansion": "default", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": "no-referrer-when-downgrade", |
| "redirection": "*", |
| "origin": [ |
| "same-http", |
| "cross-http" |
| ], |
| "subresource": "*", |
| "expectation": "omitted" |
| }, |
| { |
| "name": "secure-protocol", |
| "expansion": "default", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": "no-referrer-when-downgrade", |
| "redirection": "*", |
| "origin": [ |
| "same-https", |
| "cross-https" |
| ], |
| "subresource": "*", |
| "expectation": "stripped-referrer" |
| } |
| ] |
| }, |
| { |
| "name": "origin", |
| "title": "Referrer Policy is set to 'origin'", |
| "description": "Check that all subresources in all casses get only the origin portion of the referrer URL.", |
| "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-origin", |
| "test_expansion": [ |
| { |
| "name": "generic", |
| "expansion": "default", |
| "source_scheme": "*", |
| "delivery_type": "*", |
| "delivery_value": "origin", |
| "redirection": "*", |
| "origin": "*", |
| "subresource": "*", |
| "expectation": "origin" |
| } |
| ] |
| }, |
| { |
| "name": "same-origin", |
| "title": "Referrer Policy is set to 'same-origin'", |
| "description": "Check that cross-origin subresources get no referrer information and same-origin get the stripped referrer URL.", |
| "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-same-origin", |
| "test_expansion": [ |
| { |
| "name": "same-origin-insecure", |
| "expansion": "default", |
| "source_scheme": "http", |
| "delivery_type": "*", |
| "delivery_value": "same-origin", |
| "redirection": "*", |
| "origin": "same-http", |
| "subresource": "*", |
| "expectation": "stripped-referrer" |
| }, |
| { |
| "name": "same-origin-secure-default", |
| "expansion": "default", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": "same-origin", |
| "redirection": "*", |
| "origin": "same-https", |
| "subresource": "*", |
| "expectation": "stripped-referrer" |
| }, |
| { |
| "name": "same-origin-insecure", |
| "expansion": "override", |
| "source_scheme": "*", |
| "delivery_type": "*", |
| "delivery_value": "same-origin", |
| "redirection": "swap-origin", |
| "origin": [ |
| "same-http", |
| "same-https" |
| ], |
| "subresource": "*", |
| "expectation": "omitted" |
| }, |
| { |
| "name": "cross-origin", |
| "expansion": "default", |
| "source_scheme": "*", |
| "delivery_type": "*", |
| "delivery_value": "same-origin", |
| "redirection": "*", |
| "origin": [ |
| "cross-http", |
| "cross-https" |
| ], |
| "subresource": "*", |
| "expectation": "omitted" |
| } |
| ] |
| }, |
| { |
| "name": "origin-when-cross-origin", |
| "title": "Referrer Policy is set to 'origin-when-cross-origin'", |
| "description": "Check that cross-origin subresources get the origin portion of the referrer URL and same-origin get the stripped referrer URL.", |
| "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-origin-when-cross-origin", |
| "test_expansion": [ |
| { |
| "name": "same-origin-insecure", |
| "expansion": "default", |
| "source_scheme": "http", |
| "delivery_type": "*", |
| "delivery_value": "origin-when-cross-origin", |
| "redirection": "*", |
| "origin": "same-http", |
| "subresource": "*", |
| "expectation": "stripped-referrer" |
| }, |
| { |
| "name": "same-origin-secure-default", |
| "expansion": "default", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": "origin-when-cross-origin", |
| "redirection": "*", |
| "origin": "same-https", |
| "subresource": "*", |
| "expectation": "stripped-referrer" |
| }, |
| { |
| "name": "same-origin-upgrade", |
| "expansion": "default", |
| "source_scheme": "http", |
| "delivery_type": "*", |
| "delivery_value": "origin-when-cross-origin", |
| "redirection": "*", |
| "origin": "same-https", |
| "subresource": "*", |
| "expectation": "origin" |
| }, |
| { |
| "name": "same-origin-downgrade", |
| "expansion": "default", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": "origin-when-cross-origin", |
| "redirection": "*", |
| "origin": "same-http", |
| "subresource": "*", |
| "expectation": "origin" |
| }, |
| { |
| "name": "same-origin-insecure", |
| "expansion": "override", |
| "source_scheme": "*", |
| "delivery_type": "*", |
| "delivery_value": "origin-when-cross-origin", |
| "redirection": "swap-origin", |
| "origin": [ |
| "same-http", |
| "same-https" |
| ], |
| "subresource": "*", |
| "expectation": "origin" |
| }, |
| { |
| "name": "cross-origin", |
| "expansion": "default", |
| "source_scheme": "*", |
| "delivery_type": "*", |
| "delivery_value": "origin-when-cross-origin", |
| "redirection": "*", |
| "origin": [ |
| "cross-http", |
| "cross-https" |
| ], |
| "subresource": "*", |
| "expectation": "origin" |
| } |
| ] |
| }, |
| { |
| "name": "strict-origin", |
| "title": "Referrer Policy is set to 'strict-origin'", |
| "description": "Check that non a priori insecure subresource gets only the origin portion of the referrer URL. A priori insecure subresource gets no referrer information.", |
| "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-strict-origin", |
| "test_expansion": [ |
| { |
| "name": "insecure-protocol", |
| "expansion": "default", |
| "source_scheme": "http", |
| "delivery_type": "*", |
| "delivery_value": "strict-origin", |
| "redirection": "*", |
| "origin": [ |
| "same-http", |
| "cross-http" |
| ], |
| "subresource": "*", |
| "expectation": "origin" |
| }, |
| { |
| "name": "upgrade-protocol", |
| "expansion": "default", |
| "source_scheme": "http", |
| "delivery_type": "*", |
| "delivery_value": "strict-origin", |
| "redirection": "*", |
| "origin": [ |
| "same-https", |
| "cross-https" |
| ], |
| "subresource": "*", |
| "expectation": "origin" |
| }, |
| { |
| "name": "downgrade-protocol", |
| "expansion": "default", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": "strict-origin", |
| "redirection": "*", |
| "origin": [ |
| "same-http", |
| "cross-http" |
| ], |
| "subresource": "*", |
| "expectation": "omitted" |
| }, |
| { |
| "name": "secure-protocol", |
| "expansion": "default", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": "strict-origin", |
| "redirection": "*", |
| "origin": [ |
| "same-https", |
| "cross-https" |
| ], |
| "subresource": "*", |
| "expectation": "origin" |
| } |
| ] |
| }, |
| { |
| "name": "strict-origin-when-cross-origin", |
| "title": "Referrer Policy is set to 'strict-origin-when-cross-origin'", |
| "description": "Check that a priori insecure subresource gets no referrer information. Otherwise, cross-origin subresources get the origin portion of the referrer URL and same-origin get the stripped referrer URL.", |
| "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-strict-origin-when-cross-origin", |
| "test_expansion": [ |
| { |
| "name": "same-insecure", |
| "expansion": "default", |
| "source_scheme": "http", |
| "delivery_type": "*", |
| "delivery_value": "strict-origin-when-cross-origin", |
| "redirection": "*", |
| "origin": "same-http", |
| "subresource": "*", |
| "expectation": "stripped-referrer" |
| }, |
| { |
| "name": "same-insecure", |
| "expansion": "override", |
| "source_scheme": "http", |
| "delivery_type": "*", |
| "delivery_value": "strict-origin-when-cross-origin", |
| "redirection": "swap-origin", |
| "origin": "same-http", |
| "subresource": "*", |
| "expectation": "origin" |
| }, |
| { |
| "name": "cross-insecure", |
| "expansion": "default", |
| "source_scheme": "http", |
| "delivery_type": "*", |
| "delivery_value": "strict-origin-when-cross-origin", |
| "redirection": "*", |
| "origin": "cross-http", |
| "subresource": "*", |
| "expectation": "origin" |
| }, |
| { |
| "name": "upgrade-protocol", |
| "expansion": "default", |
| "source_scheme": "http", |
| "delivery_type": "*", |
| "delivery_value": "strict-origin-when-cross-origin", |
| "redirection": "*", |
| "origin": [ |
| "same-https", |
| "cross-https" |
| ], |
| "subresource": "*", |
| "expectation": "origin" |
| }, |
| { |
| "name": "downgrade-protocol", |
| "expansion": "default", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": "strict-origin-when-cross-origin", |
| "redirection": "*", |
| "origin": [ |
| "same-http", |
| "cross-http" |
| ], |
| "subresource": "*", |
| "expectation": "omitted" |
| }, |
| { |
| "name": "same-secure", |
| "expansion": "default", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": "strict-origin-when-cross-origin", |
| "redirection": "*", |
| "origin": "same-https", |
| "subresource": "*", |
| "expectation": "stripped-referrer" |
| }, |
| { |
| "name": "same-secure", |
| "expansion": "override", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": "strict-origin-when-cross-origin", |
| "redirection": "swap-origin", |
| "origin": "same-https", |
| "subresource": "*", |
| "expectation": "origin" |
| }, |
| { |
| "name": "cross-secure", |
| "expansion": "default", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": "strict-origin-when-cross-origin", |
| "redirection": "*", |
| "origin": "cross-https", |
| "subresource": "*", |
| "expectation": "origin" |
| } |
| ] |
| }, |
| { |
| "name": "unsafe-url", |
| "title": "Referrer Policy is set to 'unsafe-url'", |
| "description": "Check that all sub-resources get the stripped referrer URL.", |
| "specification_url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-unsafe-url", |
| "test_expansion": [ |
| { |
| "name": "generic", |
| "expansion": "default", |
| "source_scheme": "*", |
| "delivery_type": "*", |
| "delivery_value": "unsafe-url", |
| "redirection": "*", |
| "origin": "*", |
| "subresource": "*", |
| "expectation": "stripped-referrer" |
| } |
| ] |
| } |
| ], |
| "delivery_key": "referrerPolicy", |
| "excluded_tests": [ |
| { |
| "name": "cross-origin-workers", |
| "expansion": "*", |
| "source_scheme": "*", |
| "redirection": "*", |
| "delivery_type": "*", |
| "delivery_value": "*", |
| "origin": [ |
| "cross-http", |
| "cross-https" |
| ], |
| "subresource": [ |
| "worker-request", |
| "module-worker", |
| "shared-worker" |
| ], |
| "expectation": "*" |
| }, |
| { |
| "name": "upgraded-protocol-workers", |
| "expansion": "*", |
| "source_scheme": "http", |
| "delivery_type": "*", |
| "delivery_value": "*", |
| "redirection": "*", |
| "origin": [ |
| "same-https", |
| "cross-https" |
| ], |
| "subresource": [ |
| "worker-request", |
| "module-worker", |
| "shared-worker" |
| ], |
| "expectation": "*" |
| }, |
| { |
| "name": "mixed-content-insecure-subresources", |
| "expansion": "*", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": "*", |
| "redirection": "*", |
| "origin": [ |
| "same-http", |
| "cross-http" |
| ], |
| "subresource": "*", |
| "expectation": "*" |
| }, |
| { |
| "name": "area-tag", |
| "expansion": "*", |
| "source_scheme": "*", |
| "delivery_type": "*", |
| "delivery_value": "*", |
| "redirection": "*", |
| "origin": "*", |
| "subresource": "area-tag", |
| "expectation": "*" |
| }, |
| { |
| "name": "worker-requests-with-swap-origin-redirect", |
| "expansion": "*", |
| "source_scheme": "*", |
| "delivery_type": "*", |
| "delivery_value": "*", |
| "redirection": "swap-origin", |
| "origin": "*", |
| "subresource": [ |
| "worker-request", |
| "module-worker", |
| "shared-worker" |
| ], |
| "expectation": "*" |
| }, |
| { |
| "name": "overhead-for-redirection", |
| "expansion": "*", |
| "source_scheme": "*", |
| "delivery_type": "*", |
| "delivery_value": "*", |
| "redirection": [ |
| "keep-origin", |
| "swap-origin" |
| ], |
| "origin": "*", |
| "subresource": [ |
| "a-tag", |
| "area-tag" |
| ], |
| "expectation": "*" |
| }, |
| { |
| "name": "source-https-unsupported-by-web-platform-tests-runners", |
| "expansion": "*", |
| "source_scheme": "https", |
| "delivery_type": "*", |
| "delivery_value": "*", |
| "redirection": "*", |
| "origin": "*", |
| "subresource": "*", |
| "expectation": "*" |
| }, |
| { |
| "name": "<link rel=noreferrer>'s delivery_value should be no-referrer", |
| "expansion": "*", |
| "source_scheme": "*", |
| "delivery_type": "rel-noref", |
| "delivery_value": [ |
| null, |
| "no-referrer-when-downgrade", |
| "same-origin", |
| "origin", |
| "origin-when-cross-origin", |
| "strict-origin", |
| "strict-origin-when-cross-origin", |
| "unsafe-url" |
| ], |
| "redirection": "*", |
| "origin": "*", |
| "subresource": "*", |
| "expectation": "*" |
| } |
| ], |
| "test_expansion_schema": { |
| "expansion": [ |
| "default", |
| "override" |
| ], |
| "delivery_type": [ |
| "attr", |
| "rel-noref", |
| "http-rp", |
| "meta" |
| ], |
| "delivery_value": [ |
| null, |
| "no-referrer", |
| "no-referrer-when-downgrade", |
| "same-origin", |
| "origin", |
| "origin-when-cross-origin", |
| "strict-origin", |
| "strict-origin-when-cross-origin", |
| "unsafe-url" |
| ], |
| "origin": [ |
| "same-http", |
| "same-https", |
| "cross-http", |
| "cross-https" |
| ], |
| "source_scheme": [ |
| "http", |
| "https" |
| ], |
| "redirection": [ |
| "no-redirect", |
| "keep-origin", |
| "swap-origin" |
| ], |
| "subresource": [ |
| "iframe-tag", |
| "img-tag", |
| "script-tag", |
| "a-tag", |
| "area-tag", |
| "xhr-request", |
| "worker-request", |
| "module-worker", |
| "shared-worker", |
| "fetch-request" |
| ], |
| "expectation": [ |
| "omitted", |
| "origin", |
| "stripped-referrer" |
| ] |
| } |
| } |
