Service worker bypass for resource requests from suborigins

third_party/WebKit/LayoutTests/http/tests/security/suborigins/resources/sw-reject-all-with-error.js

Index: third_party/WebKit/LayoutTests/http/tests/security/suborigins/resources/sw-reject-all-with-error.js
diff --git a/third_party/WebKit/LayoutTests/http/tests/security/suborigins/resources/sw-reject-all-with-error.js b/third_party/WebKit/LayoutTests/http/tests/security/suborigins/resources/sw-reject-all-with-error.js
new file mode 100644
index 0000000000000000000000000000000000000000..258f6e0cb10ce1fc7a56ca70f030a32d2c6d2e57
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/security/suborigins/resources/sw-reject-all-with-error.js
@@ -0,0 +1,8 @@
+// This service worker, once installed, will reject all resource requests,
+// unless the resource has 'bypass' in the URL. For those URLs, it simply
+// passes through the request.
+self.addEventListener('fetch', function(event) {
+    if (event.request.url.indexOf('bypass') != -1)
+        event.respondWith(fetch.event.request);

[falken, 2016/09/20 03:48:57]

BTW event.respondWith(request) and not calling respondWith at all are supposed
to have the same behavior but go through much different code paths. To test
thoroughly you might want to test both.

[jww, 2016/09/20 04:27:47]

Acknowledged.

+    event.respondWith(Promise.reject(Error("Rejecting all requests")));

[falken, 2016/09/20 03:48:57]

I must be missing something but why are these rejects needed? All the URLs i see
in the test have "bypass" in the URL.

[jww, 2016/09/20 04:27:47]

It's a little tricky with what's going on here, but you'll note that in
suborigin-service-worker-fetch-event.html, the iframes are loaded with:
   iframe2.src =
"resources/fetch-resource.php?resource=/resources/dummy.txt&id=nonsuborigin&bypass";
This loads an iframe and, indeed, bypass is one of the URL parameters, so it
should bypass the error. However, the iframe itself takes the 'resource'
parameter (in this case, /resources/dummy.txt), and loads it. It's *that*
resource that does not have 'bypass' in the URL, and it's that resource we are
checking to see if it was intercepted.

+});