bocoup · jugglinmike · Nov 27, 2019 · Nov 29, 2019 · Nov 30, 2019 · Dec 4, 2019
diff --git a/common/refresh.py b/common/refresh.py
@@ -0,0 +1,11 @@
+def main(request, response):
+    """
+    Respond with a blank HTML document and a `Refresh` header which describes
+    an immediate redirect to the URL specified by the requests `location` query
+    string parameter
+    """
+    headers = [
+        ('Content-Type', 'text/html'),
+        ('Refresh', '0; URL={}'.format(request.GET.first('location')))
+    ]
+    return (200, headers, '')
diff --git a/fetch/api/resources/redirect.py b/fetch/api/resources/redirect.py
@@ -33,6 +33,8 @@ def main(request, response):
 
     if "redirect_status" in request.GET:
         status = int(request.GET['redirect_status'])
+    elif "redirect_status" in request.POST:
+        status = int(request.POST['redirect_status'])
 
     stashed_data['count'] += 1
 

diff --git a/fetch/metadata/generated/appcache-manifest.https.sub.html b/fetch/metadata/generated/appcache-manifest.https.sub.html
@@ -0,0 +1,296 @@
+<!DOCTYPE html>
+<!--
+This test was procedurally generated. Please do not modify it directly.
+Sources:
+- fetch/metadata/tools/fetch-metadata.conf.yml
+- fetch/metadata/tools/templates/appcache-manifest.sub.https.html
+-->
+<html lang="en">
+  <meta charset="utf-8">
+  <title>HTTP headers on request for Appcache manifest</title>
+  <script src="/resources/testharness.js"></script>
+  <script src="/resources/testharnessreport.js"></script>
+  <script src="/fetch/metadata/resources/helper.sub.js"></script>
+  <body>
+  <script>
+  'use strict';
+
+  function induceRequest(url) {
+    const iframe = document.createElement('iframe');
+    iframe.src =
+      '/fetch/metadata/resources/appcache-iframe.sub.html?manifest=' + encodeURIComponent(url);
+
+    return new Promise((resolve) => {
+        addEventListener('message', function onMessage(event) {
+          if (event.source !== iframe.contentWindow) {
+            return;
+          }
+          removeEventListener('message', onMessage);
+          resolve(event.data);
+        });
+
+        document.body.appendChild(iframe);
+      })
+      .then((message) => {
+        if (message !== 'okay') {
+          throw message;
+        }
+      })
+      .then(() => iframe.remove());
+  }
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, ['sameOrigin', 'httpOrigin']))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_not_own_property(headers, 'sec-fetch-site');
+    });
+  }, 'sec-fetch-site - HTTPS downgrade (header not sent)');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, ['httpOrigin', 'sameOrigin']))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-site');
+          assert_equals(headers['sec-fetch-site'], 'cross-site');
+    });
+  }, 'sec-fetch-site - HTTPS upgrade');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, ['sameOrigin', 'httpOrigin', 'sameOrigin']))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-site');
+          assert_equals(headers['sec-fetch-site'], 'cross-site');
+    });
+  }, 'sec-fetch-site - HTTPS downgrade-upgrade');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, ['sameOrigin', 'crossSite', 'sameOrigin']))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-site');
+          assert_equals(headers['sec-fetch-site'], 'cross-site');
+    });
+  }, 'sec-fetch-site - Same-Origin -> Cross-Site -> Same-Origin redirect');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, ['crossSite', 'sameOrigin']))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-site');
+          assert_equals(headers['sec-fetch-site'], 'cross-site');
+    });
+  }, 'sec-fetch-site - Cross-Site -> Same Origin');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, ['crossSite', 'sameSite']))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-site');
+          assert_equals(headers['sec-fetch-site'], 'cross-site');
+    });
+  }, 'sec-fetch-site - Cross-Site -> Same-Site');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, ['crossSite', 'crossSite']))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-site');
+          assert_equals(headers['sec-fetch-site'], 'cross-site');
+    });
+  }, 'sec-fetch-site - Cross-Site -> Cross-Site');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, ['sameOrigin', 'sameOrigin']))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-site');
+          assert_equals(headers['sec-fetch-site'], 'same-origin');
+    });
+  }, 'sec-fetch-site - Same-Origin -> Same Origin');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, ['sameOrigin', 'sameSite']))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-site');
+          assert_equals(headers['sec-fetch-site'], 'same-site');
+    });
+  }, 'sec-fetch-site - Same-Origin -> Same-Site');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, ['sameOrigin', 'crossSite']))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-site');
+          assert_equals(headers['sec-fetch-site'], 'cross-site');
+    });
+  }, 'sec-fetch-site - Same-Origin -> Cross-Site');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, ['sameSite', 'sameOrigin']))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-site');
+          assert_equals(headers['sec-fetch-site'], 'same-site');
+    });
+  }, 'sec-fetch-site - Same-Site -> Same Origin');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, ['sameSite', 'sameSite']))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-site');
+          assert_equals(headers['sec-fetch-site'], 'same-site');
+    });
+  }, 'sec-fetch-site - Same-Site -> Same-Site');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, ['sameSite', 'crossSite']))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-site');
+          assert_equals(headers['sec-fetch-site'], 'cross-site');
+    });
+  }, 'sec-fetch-site - Same-Site -> Cross-Site');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, ['sameOrigin', 'httpOrigin', 'sameOrigin']))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-site');
+          assert_equals(headers['sec-fetch-site'], 'cross-site');
+    });
+  }, 'sec-fetch-site - HTTPS downgrade-upgrade');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, []))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-mode');
+          assert_equals(headers['sec-fetch-mode'], 'no-cors');
+    });
+  }, 'sec-fetch-mode');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, []))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_own_property(headers, 'sec-fetch-dest');
+          assert_equals(headers['sec-fetch-dest'], 'empty');
+    });
+  }, 'sec-fetch-dest');
+
+  promise_test(() => {
+    const key = '{{uuid()}}';
+    assert_precondition(
+      !!window.applicationCache,
+      'Application Cache is not supported.'
+    );
+
+    return induceRequest(makeRequestURL(key, []))
+      .then(() => retrieve(key))
+      .then((headers) => {
+          assert_not_own_property(headers, 'sec-fetch-user');
+    });
+  }, 'sec-fetch-user');
+  </script>
+  </body>
+</html>