Skip to content

Commit 0b0f9f3

Browse files
yaoxiachromiumchromium-wpt-export-bot
yaoxiachromium
authored and
chromium-wpt-export-bot
committed
[shared storage] Support cross-origin worklet
For the sharedStorage.createWorklet() API, relax the same-origin restriction to allow cross-origin script, in which case a cross-origin worklet will be created. How: - Rely on CORS for the worklet to be loaded/used by the embedder. - Leverage the existing process allocation and management logic from service workers and directly re-use SiteInstanceImpl::CreateForServiceWorker(). To keep this CL focused, renaming will occur in a separate CL, as it will involve renaming other downstream components like 'UnmatchedServiceWorkerProcessTracker'. Explainer: WICG/shared-storage#130 Spec: WICG/shared-storage#131 Design doc: https://docs.google.com/document/d/1QTaaroCMeFVZVghI6JkUcDvmDQEacjvpyTfk6mpvQhA/edit?usp=sharing Bug: 325302836 Change-Id: I11c1fc87bc76f4400c54d9fa809349d1d1781247
1 parent 4719225 commit 0b0f9f3

6 files changed

+166
-0
lines changed

‎shared-storage/cross-origin-create-worklet-credentials-include.tentative.https.sub.html

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<!doctype html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="/common/utils.js"></script>
5+
<script src="/shared-storage/resources/util.js"></script>
6+
<script src="/fenced-frame/resources/utils.js"></script>
7+
8+
<body>
9+
<script>
10+
'use strict';
11+
12+
promise_test(async () => {
13+
const ancestor_key = token();
14+
document.cookie = "key0=value0";
15+
const crossOrigin = 'https://{{domains[www]}}:{{ports[https][0]}}';
16+
const helper_url = crossOrigin +
17+
`/shared-storage/resources/credentials-test-helper.py` +
18+
`?access_control_allow_origin_header=${window.origin}` +
19+
`&access_control_allow_credentials_header=true` +
20+
`&token=${ancestor_key}`;
21+
22+
const worklet = await sharedStorage.createWorklet(
23+
helper_url + `&action=store-cookie`,
24+
{ credentials: "include" });
25+
26+
const request_cookie_fetch_response =
27+
await fetch(helper_url + `&action=get-cookie`);
28+
29+
const request_cookie_text = await request_cookie_fetch_response.text();
30+
31+
assert_equals(request_cookie_text, "NO_COOKIE_HEADER");
32+
}, 'createWorklet() with cross-origin module script and credentials "include"');
33+
34+
</script>
35+
</body>

‎shared-storage/cross-origin-create-worklet-credentials-omit.tentative.https.sub.html

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<!doctype html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="/common/utils.js"></script>
5+
<script src="/shared-storage/resources/util.js"></script>
6+
<script src="/fenced-frame/resources/utils.js"></script>
7+
8+
<body>
9+
<script>
10+
'use strict';
11+
12+
promise_test(async () => {
13+
const ancestor_key = token();
14+
document.cookie = "key0=value0";
15+
const crossOrigin = 'https://{{domains[www]}}:{{ports[https][0]}}';
16+
const helper_url = crossOrigin +
17+
`/shared-storage/resources/credentials-test-helper.py` +
18+
`?access_control_allow_origin_header=${window.origin}` +
19+
`&token=${ancestor_key}`;
20+
21+
const worklet = await sharedStorage.createWorklet(
22+
helper_url + `&action=store-cookie`,
23+
{ credentials: "omit" });
24+
25+
const request_cookie_fetch_response =
26+
await fetch(helper_url + `&action=get-cookie`);
27+
28+
const request_cookie_text = await request_cookie_fetch_response.text();
29+
30+
assert_equals(request_cookie_text, "NO_COOKIE_HEADER");
31+
}, 'createWorklet() with cross-origin module script and credentials "omit"');
32+
33+
</script>
34+
</body>

‎shared-storage/cross-origin-create-worklet-credentials-same-origin.tentative.https.sub.html

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<!doctype html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="/common/utils.js"></script>
5+
<script src="/shared-storage/resources/util.js"></script>
6+
<script src="/fenced-frame/resources/utils.js"></script>
7+
8+
<body>
9+
<script>
10+
'use strict';
11+
12+
promise_test(async () => {
13+
const ancestor_key = token();
14+
document.cookie = "key0=value0";
15+
const crossOrigin = 'https://{{domains[www]}}:{{ports[https][0]}}';
16+
const helper_url = crossOrigin +
17+
`/shared-storage/resources/credentials-test-helper.py` +
18+
`?access_control_allow_origin_header=${window.origin}` +
19+
`&token=${ancestor_key}`;
20+
21+
const worklet = await sharedStorage.createWorklet(
22+
helper_url + `&action=store-cookie`,
23+
{ credentials: "same-origin" });
24+
25+
const request_cookie_fetch_response =
26+
await fetch(helper_url + `&action=get-cookie`);
27+
28+
const request_cookie_text = await request_cookie_fetch_response.text();
29+
30+
assert_equals(request_cookie_text, "NO_COOKIE_HEADER");
31+
}, 'createWorklet() with cross-origin module script and credentials "same-origin"');
32+
33+
</script>
34+
</body>

‎shared-storage/cross-origin-create-worklet-failure-missing-access-control-allow-credentials.tentative.https.sub.html

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<!doctype html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="/common/utils.js"></script>
5+
<script src="/shared-storage/resources/util.js"></script>
6+
<script src="/fenced-frame/resources/utils.js"></script>
7+
8+
<body>
9+
<script>
10+
'use strict';
11+
12+
promise_test(async t => {
13+
const ancestor_key = token();
14+
const crossOrigin = 'https://{{domains[www]}}:{{ports[https][0]}}';
15+
const helper_url = crossOrigin +
16+
`/shared-storage/resources/credentials-test-helper.py` +
17+
`?access_control_allow_origin_header=${window.origin}` +
18+
`&token=${ancestor_key}`;
19+
20+
return promise_rejects_dom(t, "OperationError",
21+
sharedStorage.createWorklet(
22+
helper_url + `&action=store-cookie`,
23+
{ credentials: "include" }));
24+
}, 'createWorklet() with cross-origin module script and credentials ' +
25+
'"include", and without the Access-Control-Allow-Credentials response ' +
26+
'header');
27+
28+
</script>
29+
</body>

‎shared-storage/cross-origin-create-worklet-failure-missing-access-control-allow-origin.tentative.https.sub.html

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<!doctype html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="/common/utils.js"></script>
5+
<script src="/shared-storage/resources/util.js"></script>
6+
<script src="/fenced-frame/resources/utils.js"></script>
7+
8+
<body>
9+
<script>
10+
'use strict';
11+
12+
promise_test(async t => {
13+
const ancestor_key = token();
14+
const crossOrigin = 'https://{{domains[www]}}:{{ports[https][0]}}';
15+
const helper_url = crossOrigin +
16+
`/shared-storage/resources/credentials-test-helper.py` +
17+
`&access_control_allow_credentials_header=true` +
18+
`&token=${ancestor_key}`;
19+
20+
return promise_rejects_dom(t, "OperationError",
21+
sharedStorage.createWorklet(
22+
helper_url + `&action=store-cookie`,
23+
{ credentials: "include" }));
24+
}, 'createWorklet() with cross-origin module script and credentials ' +
25+
'"include", and without the Access-Control-Allow-Origin response header');
26+
27+
</script>
28+
</body>

‎shared-storage/resources/credentials-test-helper.py

+6
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,12 @@ def main(request, response):
1313
response.status = 200
1414
response.headers.append(b"Content-Type", b"text/javascript")
1515

16+
if b"access_control_allow_credentials_header" in request.GET:
17+
response.headers.append(b"Access-Control-Allow-Credentials", request.GET[b"access_control_allow_credentials_header"])
18+
19+
if b"access_control_allow_origin_header" in request.GET:
20+
response.headers.append(b"Access-Control-Allow-Origin", request.GET[b"access_control_allow_origin_header"])
21+
1622
if action == b"store-cookie":
1723
cookie = request.headers.get(b"Cookie", b"NO_COOKIE_HEADER")
1824
request.server.stash.put(token, cookie)

0 commit comments

Comments
 (0)