SameSite: Strict/Lax behavior.

content/browser/frame_host/render_frame_message_filter_browsertest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/test/histogram_tester.h"
 #include "content/browser/bad_message.h"
@@ skipping 21 matching lines @@
 
 std::string GetCookieFromJS(RenderFrameHost* frame) {
   std::string cookie;
   EXPECT_TRUE(ExecuteScriptAndExtractString(
       frame, "window.domAutomationController.send(document.cookie);", &cookie));
   return cookie;
 }
 
 }  // namespace
 
-using RenderFrameMessageFilterBrowserTest = ContentBrowserTest;
+class RenderFrameMessageFilterBrowserTest : public ContentBrowserTest {
+ protected:
+  void SetUp() override {
+    base::CommandLine::ForCurrentProcess()->AppendSwitch(
+        switches::kEnableExperimentalWebPlatformFeatures);
+    ContentBrowserTest::SetUp();
+  }
+};
 
 // Exercises basic cookie operations via javascript, including an http page
 // interacting with secure cookies.
 IN_PROC_BROWSER_TEST_F(RenderFrameMessageFilterBrowserTest, Cookies) {
   host_resolver()->AddRule("*", "127.0.0.1");
   ASSERT_TRUE(embedded_test_server()->Start());
   SetupCrossSiteRedirector(embedded_test_server());
 
   net::EmbeddedTestServer https_server(net::EmbeddedTestServer::TYPE_HTTPS);
   https_server.AddDefaultHandlers(
@@ skipping 20 matching lines @@
 
   EXPECT_NE(web_contents_http->GetSiteInstance()->GetProcess(),
             web_contents_https->GetSiteInstance()->GetProcess());
 
   EXPECT_EQ("", GetCookieFromJS(web_contents_https->GetMainFrame()));
   EXPECT_EQ("", GetCookieFromJS(web_contents_http->GetMainFrame()));
 
   // Non-TLS page writes secure cookie.
   EXPECT_TRUE(ExecuteScript(web_contents_http->GetMainFrame(),
                             "document.cookie = 'A=1; secure;';"));
-  EXPECT_EQ("A=1", GetCookieFromJS(web_contents_https->GetMainFrame()));
+  EXPECT_EQ("", GetCookieFromJS(web_contents_https->GetMainFrame()));
   EXPECT_EQ("", GetCookieFromJS(web_contents_http->GetMainFrame()));
 
   // TLS page writes not-secure cookie.
   EXPECT_TRUE(ExecuteScript(web_contents_http->GetMainFrame(),
                             "document.cookie = 'B=2';"));
-  EXPECT_EQ("A=1; B=2", GetCookieFromJS(web_contents_https->GetMainFrame()));
+  EXPECT_EQ("B=2", GetCookieFromJS(web_contents_https->GetMainFrame()));
   EXPECT_EQ("B=2", GetCookieFromJS(web_contents_http->GetMainFrame()));
 
-  // Non-TLS page writes secure cookie.
+  // TLS page writes secure cookie.
   EXPECT_TRUE(ExecuteScript(web_contents_https->GetMainFrame(),
                             "document.cookie = 'C=3;secure;';"));
-  EXPECT_EQ("A=1; B=2; C=3",
+  EXPECT_EQ("B=2; C=3",
             GetCookieFromJS(web_contents_https->GetMainFrame()));
   EXPECT_EQ("B=2", GetCookieFromJS(web_contents_http->GetMainFrame()));
 
   // TLS page writes not-secure cookie.
   EXPECT_TRUE(ExecuteScript(web_contents_https->GetMainFrame(),
                             "document.cookie = 'D=4';"));
-  EXPECT_EQ("A=1; B=2; C=3; D=4",
+  EXPECT_EQ("B=2; C=3; D=4",
             GetCookieFromJS(web_contents_https->GetMainFrame()));
   EXPECT_EQ("B=2; D=4", GetCookieFromJS(web_contents_http->GetMainFrame()));
 }
 
 // SameSite cookies (that aren't marked as http-only) should be available to
 // JavaScript.
 IN_PROC_BROWSER_TEST_F(RenderFrameMessageFilterBrowserTest, SameSiteCookies) {
   host_resolver()->AddRule("*", "127.0.0.1");
   ASSERT_TRUE(embedded_test_server()->Start());
   SetupCrossSiteRedirector(embedded_test_server());
 
-  // The server sends a SameSite cookie. The RenderFrameMessageFilter should
-  // allow this to be sent to the renderer.
-  GURL url = embedded_test_server()->GetURL("/set-cookie?samesite=1;SameSite");
+  // The server sets five cookies on 'a.com' and on 'b.com', then loads a
+  // page that frames both 'a.com' and 'b.com' under 'a.com'.
+  std::string cookies_to_set =
+      "/set-cookie?normal=1"
+      "&strict=1;SameSite=Strict"
+      "&lax=1;SameSite=Lax"
+      "&strict-http=1;SameSite=Strict;httponly"
+      "&lax-http=1;SameSite=Lax;httponly";
+
+  GURL url = embedded_test_server()->GetURL("a.com", cookies_to_set);
+  NavigateToURL(shell(), url);
+  url = embedded_test_server()->GetURL("b.com", cookies_to_set);
+  NavigateToURL(shell(), url);
+  url = embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(a(),b())");
   NavigateToURL(shell(), url);
 
   WebContentsImpl* web_contents =
       static_cast<WebContentsImpl*>(shell()->web_contents());
-  EXPECT_EQ("http://127.0.0.1/",
-            web_contents->GetSiteInstance()->GetSiteURL().spec());
+  RenderFrameHost* main_frame = web_contents->GetMainFrame();
+  RenderFrameHost* a_iframe =
+      web_contents->GetFrameTree()->root()->child_at(0)->current_frame_host();
+  RenderFrameHost* b_iframe =
+      web_contents->GetFrameTree()->root()->child_at(1)->current_frame_host();
 
-  EXPECT_EQ("samesite=1", GetCookieFromJS(web_contents->GetMainFrame()));
+  // The top-level frame should get both kinds of same-site cookies.
+  EXPECT_EQ("normal=1; strict=1; lax=1", GetCookieFromJS(main_frame));
+
+  // Same-site cookies will be delievered to the 'a.com' frame, as it is same-
+  // site with its ancestors.
+  EXPECT_EQ("normal=1; strict=1; lax=1", GetCookieFromJS(a_iframe));
+
+  // Same-site cookies should not be delievered to the 'b.com' frame, as it
+  // isn't same-site with its ancestors.
+  EXPECT_EQ("normal=1", GetCookieFromJS(b_iframe));
 }
 
 // The RenderFrameMessageFilter will kill processes when they access the cookies
 // of sites other than the site the process is dedicated to, under site
 // isolation.
 IN_PROC_BROWSER_TEST_F(RenderFrameMessageFilterBrowserTest,
                        CrossSiteCookieSecurityEnforcement) {
   // The code under test is only active under site isolation.
   if (!AreAllSitesIsolatedForTesting()) {
     return;
@@ skipping 89 matching lines @@
   // If the message had gone through, we'd have marked the RFH as dead but
   // left the RPH and its connection alive, and the Wait below would hang.
   web_process_killed.Wait();
 
   ASSERT_FALSE(web_rfh->GetProcess()->HasConnection());
   ASSERT_FALSE(web_rfh->IsRenderFrameLive());
   ASSERT_FALSE(web_process_killed.did_exit_normally());
 }
 
 }  // namespace content