cookie_settings_unittest.cc 45 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050
  1. // Copyright 2018 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "services/network/cookie_settings.h"
  5. #include "base/test/metrics/histogram_tester.h"
  6. #include "base/test/scoped_feature_list.h"
  7. #include "base/test/task_environment.h"
  8. #include "components/content_settings/core/common/content_settings.h"
  9. #include "net/base/features.h"
  10. #include "net/cookies/canonical_cookie.h"
  11. #include "net/cookies/canonical_cookie_test_helpers.h"
  12. #include "net/cookies/cookie_constants.h"
  13. #include "net/cookies/cookie_util.h"
  14. #include "net/cookies/site_for_cookies.h"
  15. #include "services/network/public/cpp/features.h"
  16. #include "testing/gtest/include/gtest/gtest.h"
  17. #include "url/origin.h"
  18. namespace network {
  19. namespace {
  20. using QueryReason = CookieSettings::QueryReason;
  21. using testing::_;
  22. using testing::ElementsAre;
  23. using testing::IsEmpty;
  24. using testing::UnorderedElementsAre;
  25. constexpr char kAllowedRequestsHistogram[] =
  26. "API.StorageAccess.AllowedRequests2";
  27. constexpr char kDomainURL[] = "http://example.com";
  28. constexpr char kURL[] = "http://foo.com";
  29. constexpr char kOtherURL[] = "http://other.com";
  30. constexpr char kSubDomainURL[] = "http://www.corp.example.com";
  31. constexpr char kDomain[] = "example.com";
  32. constexpr char kDotDomain[] = ".example.com";
  33. constexpr char kSubDomain[] = "www.corp.example.com";
  34. constexpr char kOtherDomain[] = "not-example.com";
  35. constexpr char kDomainWildcardPattern[] = "[*.]example.com";
  36. constexpr char kFPSOwnerURL[] = "https://fps-owner.test";
  37. constexpr char kFPSMemberURL[] = "https://fps-member.test";
  38. constexpr char kUnrelatedURL[] = "http://unrelated.com";
  39. std::unique_ptr<net::CanonicalCookie> MakeCanonicalCookie(
  40. const std::string& name,
  41. const std::string& domain,
  42. bool sameparty,
  43. absl::optional<net::CookiePartitionKey> cookie_partition_key =
  44. absl::nullopt) {
  45. return net::CanonicalCookie::CreateUnsafeCookieForTesting(
  46. name, "1", domain, /*path=*/"/", /*creation=*/base::Time(),
  47. /*expiration=*/base::Time(), /*last_access=*/base::Time(),
  48. /*last_update=*/base::Time(),
  49. /*secure=*/true, /*httponly=*/false, net::CookieSameSite::UNSPECIFIED,
  50. net::CookiePriority::COOKIE_PRIORITY_DEFAULT, sameparty,
  51. cookie_partition_key);
  52. }
  53. class CookieSettingsTest : public testing::TestWithParam<bool> {
  54. public:
  55. CookieSettingsTest()
  56. : task_environment_(base::test::TaskEnvironment::TimeSource::MOCK_TIME) {
  57. features_.InitWithFeatureState(net::features::kStorageAccessAPI,
  58. IsStorageAccessAPIEnabled());
  59. }
  60. ContentSettingPatternSource CreateSetting(
  61. const std::string& primary_pattern,
  62. const std::string& secondary_pattern,
  63. ContentSetting setting,
  64. base::Time expiration = base::Time()) {
  65. return ContentSettingPatternSource(
  66. ContentSettingsPattern::FromString(primary_pattern),
  67. ContentSettingsPattern::FromString(secondary_pattern),
  68. base::Value(setting), std::string(), false /* incognito */, expiration);
  69. }
  70. void FastForwardTime(base::TimeDelta delta) {
  71. task_environment_.FastForwardBy(delta);
  72. }
  73. bool IsStorageAccessAPIEnabled() const { return GetParam(); }
  74. // Assumes that cookie access would be blocked if not for a Storage Access API
  75. // grant.
  76. ContentSetting SettingWithStorageAccessGrantOverride() const {
  77. return IsStorageAccessAPIEnabled() ? CONTENT_SETTING_ALLOW
  78. : CONTENT_SETTING_BLOCK;
  79. }
  80. private:
  81. base::test::ScopedFeatureList features_;
  82. base::test::TaskEnvironment task_environment_;
  83. };
  84. TEST_P(CookieSettingsTest, GetCookieSettingDefault) {
  85. CookieSettings settings;
  86. EXPECT_EQ(settings.GetCookieSetting(GURL(kURL), GURL(kURL), nullptr,
  87. QueryReason::kCookies),
  88. CONTENT_SETTING_ALLOW);
  89. }
  90. TEST_P(CookieSettingsTest, GetCookieSetting) {
  91. CookieSettings settings;
  92. settings.set_content_settings(
  93. {CreateSetting(kURL, kURL, CONTENT_SETTING_BLOCK)});
  94. EXPECT_EQ(settings.GetCookieSetting(GURL(kURL), GURL(kURL), nullptr,
  95. QueryReason::kCookies),
  96. CONTENT_SETTING_BLOCK);
  97. }
  98. TEST_P(CookieSettingsTest, GetCookieSettingMustMatchBothPatterns) {
  99. CookieSettings settings;
  100. // This setting needs kOtherURL as the secondary pattern.
  101. settings.set_content_settings(
  102. {CreateSetting(kURL, kOtherURL, CONTENT_SETTING_BLOCK)});
  103. EXPECT_EQ(settings.GetCookieSetting(GURL(kURL), GURL(kURL), nullptr,
  104. QueryReason::kCookies),
  105. CONTENT_SETTING_ALLOW);
  106. EXPECT_EQ(settings.GetCookieSetting(GURL(kURL), GURL(kOtherURL), nullptr,
  107. QueryReason::kCookies),
  108. CONTENT_SETTING_BLOCK);
  109. }
  110. TEST_P(CookieSettingsTest, GetCookieSettingGetsFirstSetting) {
  111. CookieSettings settings;
  112. settings.set_content_settings(
  113. {CreateSetting(kURL, kURL, CONTENT_SETTING_BLOCK),
  114. CreateSetting(kURL, kURL, CONTENT_SETTING_SESSION_ONLY)});
  115. EXPECT_EQ(settings.GetCookieSetting(GURL(kURL), GURL(kURL), nullptr,
  116. QueryReason::kCookies),
  117. CONTENT_SETTING_BLOCK);
  118. }
  119. TEST_P(CookieSettingsTest, GetCookieSettingDontBlockThirdParty) {
  120. base::HistogramTester histogram_tester;
  121. histogram_tester.ExpectTotalCount(kAllowedRequestsHistogram, 0);
  122. CookieSettings settings;
  123. settings.set_content_settings(
  124. {CreateSetting("*", "*", CONTENT_SETTING_ALLOW)});
  125. settings.set_block_third_party_cookies(false);
  126. EXPECT_EQ(settings.GetCookieSetting(GURL(kURL), GURL(kOtherURL), nullptr,
  127. QueryReason::kCookies),
  128. CONTENT_SETTING_ALLOW);
  129. histogram_tester.ExpectTotalCount(kAllowedRequestsHistogram, 1);
  130. histogram_tester.ExpectBucketCount(
  131. kAllowedRequestsHistogram,
  132. static_cast<int>(net::cookie_util::StorageAccessResult::ACCESS_ALLOWED),
  133. 1);
  134. }
  135. TEST_P(CookieSettingsTest, GetCookieSettingBlockThirdParty) {
  136. CookieSettings settings;
  137. settings.set_content_settings(
  138. {CreateSetting("*", "*", CONTENT_SETTING_ALLOW)});
  139. settings.set_block_third_party_cookies(true);
  140. EXPECT_EQ(settings.GetCookieSetting(GURL(kURL), GURL(kOtherURL), nullptr,
  141. QueryReason::kCookies),
  142. CONTENT_SETTING_BLOCK);
  143. }
  144. TEST_P(CookieSettingsTest, GetCookieSettingDontBlockThirdPartyWithException) {
  145. CookieSettings settings;
  146. settings.set_content_settings(
  147. {CreateSetting(kURL, kOtherURL, CONTENT_SETTING_ALLOW)});
  148. settings.set_block_third_party_cookies(true);
  149. EXPECT_EQ(settings.GetCookieSetting(GURL(kURL), GURL(kOtherURL), nullptr,
  150. QueryReason::kCookies),
  151. CONTENT_SETTING_ALLOW);
  152. }
  153. // The Storage Access API should unblock storage access that would otherwise be
  154. // blocked.
  155. TEST_P(CookieSettingsTest, GetCookieSettingSAAUnblocks) {
  156. GURL top_level_url = GURL(kURL);
  157. GURL url = GURL(kOtherURL);
  158. GURL third_url = GURL(kDomainURL);
  159. base::HistogramTester histogram_tester;
  160. histogram_tester.ExpectTotalCount(kAllowedRequestsHistogram, 0);
  161. CookieSettings settings;
  162. settings.set_content_settings(
  163. {CreateSetting("*", "*", CONTENT_SETTING_ALLOW)});
  164. settings.set_block_third_party_cookies(true);
  165. settings.set_storage_access_grants(
  166. {CreateSetting(url.host(), top_level_url.host(), CONTENT_SETTING_ALLOW)});
  167. // When requesting our setting for the embedder/top-level combination our
  168. // grant is for access should be allowed. For any other domain pairs access
  169. // should still be blocked.
  170. EXPECT_EQ(settings.GetCookieSetting(url, top_level_url, nullptr,
  171. QueryReason::kCookies),
  172. SettingWithStorageAccessGrantOverride());
  173. histogram_tester.ExpectTotalCount(kAllowedRequestsHistogram, 1);
  174. histogram_tester.ExpectBucketCount(
  175. kAllowedRequestsHistogram,
  176. static_cast<int>(
  177. IsStorageAccessAPIEnabled()
  178. ? net::cookie_util::StorageAccessResult::
  179. ACCESS_ALLOWED_STORAGE_ACCESS_GRANT
  180. : net::cookie_util::StorageAccessResult::ACCESS_BLOCKED),
  181. 1);
  182. // Invalid pair the |top_level_url| granting access to |url| is now
  183. // being loaded under |url| as the top level url.
  184. EXPECT_EQ(settings.GetCookieSetting(top_level_url, url, nullptr,
  185. QueryReason::kCookies),
  186. CONTENT_SETTING_BLOCK);
  187. histogram_tester.ExpectTotalCount(kAllowedRequestsHistogram, 2);
  188. histogram_tester.ExpectBucketCount(
  189. kAllowedRequestsHistogram,
  190. static_cast<int>(net::cookie_util::StorageAccessResult::
  191. ACCESS_ALLOWED_STORAGE_ACCESS_GRANT),
  192. IsStorageAccessAPIEnabled() ? 1 : 0);
  193. histogram_tester.ExpectBucketCount(
  194. kAllowedRequestsHistogram,
  195. static_cast<int>(net::cookie_util::StorageAccessResult::ACCESS_BLOCKED),
  196. IsStorageAccessAPIEnabled() ? 1 : 2);
  197. // Invalid pairs where a |third_url| is used.
  198. EXPECT_EQ(
  199. settings.GetCookieSetting(url, third_url, nullptr, QueryReason::kCookies),
  200. CONTENT_SETTING_BLOCK);
  201. EXPECT_EQ(settings.GetCookieSetting(third_url, top_level_url, nullptr,
  202. QueryReason::kCookies),
  203. CONTENT_SETTING_BLOCK);
  204. // If cookies are globally blocked, SAA grants should be ignored.
  205. {
  206. settings.set_content_settings(
  207. {CreateSetting("*", "*", CONTENT_SETTING_BLOCK)});
  208. settings.set_block_third_party_cookies(true);
  209. base::HistogramTester histogram_tester_2;
  210. EXPECT_EQ(settings.GetCookieSetting(url, top_level_url, nullptr,
  211. QueryReason::kCookies),
  212. CONTENT_SETTING_BLOCK);
  213. histogram_tester_2.ExpectTotalCount(kAllowedRequestsHistogram, 1);
  214. histogram_tester_2.ExpectBucketCount(
  215. kAllowedRequestsHistogram,
  216. static_cast<int>(net::cookie_util::StorageAccessResult::ACCESS_BLOCKED),
  217. 1);
  218. }
  219. }
  220. // Subdomains of the granted embedding url should not gain access if a valid
  221. // grant exists.
  222. TEST_P(CookieSettingsTest, GetCookieSettingSAAResourceWildcards) {
  223. GURL top_level_url = GURL(kURL);
  224. GURL url = GURL(kDomainURL);
  225. CookieSettings settings;
  226. settings.set_content_settings(
  227. {CreateSetting("*", "*", CONTENT_SETTING_ALLOW)});
  228. settings.set_block_third_party_cookies(true);
  229. settings.set_storage_access_grants(
  230. {CreateSetting(kDomain, top_level_url.host(), CONTENT_SETTING_ALLOW)});
  231. EXPECT_EQ(settings.GetCookieSetting(url, top_level_url, nullptr,
  232. QueryReason::kCookies),
  233. SettingWithStorageAccessGrantOverride());
  234. EXPECT_EQ(settings.GetCookieSetting(GURL(kSubDomainURL), top_level_url,
  235. nullptr, QueryReason::kCookies),
  236. CONTENT_SETTING_BLOCK);
  237. }
  238. // Subdomains of the granted top level url should not grant access if a valid
  239. // grant exists.
  240. TEST_P(CookieSettingsTest, GetCookieSettingSAATopLevelWildcards) {
  241. GURL top_level_url = GURL(kDomainURL);
  242. GURL url = GURL(kURL);
  243. CookieSettings settings;
  244. settings.set_content_settings(
  245. {CreateSetting("*", "*", CONTENT_SETTING_ALLOW)});
  246. settings.set_block_third_party_cookies(true);
  247. settings.set_storage_access_grants(
  248. {CreateSetting(url.host(), kDomain, CONTENT_SETTING_ALLOW)});
  249. EXPECT_EQ(settings.GetCookieSetting(url, top_level_url, nullptr,
  250. QueryReason::kCookies),
  251. SettingWithStorageAccessGrantOverride());
  252. EXPECT_EQ(settings.GetCookieSetting(url, GURL(kSubDomainURL), nullptr,
  253. QueryReason::kCookies),
  254. CONTENT_SETTING_BLOCK);
  255. }
  256. // Any Storage Access API grant should not override an explicit setting to block
  257. // cookie access.
  258. TEST_P(CookieSettingsTest, GetCookieSettingSAARespectsSettings) {
  259. GURL top_level_url = GURL(kURL);
  260. GURL url = GURL(kOtherURL);
  261. CookieSettings settings;
  262. settings.set_content_settings(
  263. {CreateSetting("*", "*", CONTENT_SETTING_BLOCK)});
  264. settings.set_storage_access_grants(
  265. {CreateSetting(url.host(), top_level_url.host(), CONTENT_SETTING_ALLOW)});
  266. EXPECT_EQ(settings.GetCookieSetting(url, top_level_url, nullptr,
  267. QueryReason::kCookies),
  268. CONTENT_SETTING_BLOCK);
  269. }
  270. // Once a grant expires access should no longer be given.
  271. TEST_P(CookieSettingsTest, GetCookieSettingSAAExpiredGrant) {
  272. GURL top_level_url = GURL(kURL);
  273. GURL url = GURL(kOtherURL);
  274. CookieSettings settings;
  275. settings.set_content_settings(
  276. {CreateSetting("*", "*", CONTENT_SETTING_ALLOW)});
  277. settings.set_block_third_party_cookies(true);
  278. base::Time expiration_time = base::Time::Now() + base::Seconds(100);
  279. settings.set_storage_access_grants(
  280. {CreateSetting(url.host(), top_level_url.host(), CONTENT_SETTING_ALLOW,
  281. expiration_time)});
  282. // When requesting our setting for the embedder/top-level combination our
  283. // grant is for access should be allowed. For any other domain pairs access
  284. // should still be blocked.
  285. EXPECT_EQ(settings.GetCookieSetting(url, top_level_url, nullptr,
  286. QueryReason::kCookies),
  287. SettingWithStorageAccessGrantOverride());
  288. // If we fastforward past the expiration of our grant the result should be
  289. // CONTENT_SETTING_BLOCK now.
  290. FastForwardTime(base::Seconds(101));
  291. EXPECT_EQ(settings.GetCookieSetting(url, top_level_url, nullptr,
  292. QueryReason::kCookies),
  293. CONTENT_SETTING_BLOCK);
  294. }
  295. TEST_P(CookieSettingsTest, CreateDeleteCookieOnExitPredicateNoSettings) {
  296. CookieSettings settings;
  297. EXPECT_FALSE(settings.CreateDeleteCookieOnExitPredicate());
  298. }
  299. TEST_P(CookieSettingsTest, CreateDeleteCookieOnExitPredicateNoSessionOnly) {
  300. CookieSettings settings;
  301. settings.set_content_settings(
  302. {CreateSetting("*", "*", CONTENT_SETTING_ALLOW)});
  303. EXPECT_FALSE(settings.CreateDeleteCookieOnExitPredicate());
  304. }
  305. TEST_P(CookieSettingsTest, CreateDeleteCookieOnExitPredicateSessionOnly) {
  306. CookieSettings settings;
  307. settings.set_content_settings(
  308. {CreateSetting("*", "*", CONTENT_SETTING_SESSION_ONLY)});
  309. EXPECT_TRUE(settings.CreateDeleteCookieOnExitPredicate().Run(kURL, false));
  310. }
  311. TEST_P(CookieSettingsTest, CreateDeleteCookieOnExitPredicateAllow) {
  312. CookieSettings settings;
  313. settings.set_content_settings(
  314. {CreateSetting("*", "*", CONTENT_SETTING_ALLOW),
  315. CreateSetting("*", "*", CONTENT_SETTING_SESSION_ONLY)});
  316. EXPECT_FALSE(settings.CreateDeleteCookieOnExitPredicate().Run(kURL, false));
  317. }
  318. TEST_P(CookieSettingsTest, GetCookieSettingSecureOriginCookiesAllowed) {
  319. CookieSettings settings;
  320. settings.set_secure_origin_cookies_allowed_schemes({"chrome"});
  321. settings.set_block_third_party_cookies(true);
  322. EXPECT_EQ(
  323. settings.GetCookieSetting(GURL("https://foo.com") /* url */,
  324. GURL("chrome://foo") /* first_party_url */,
  325. nullptr /* source */, QueryReason::kCookies),
  326. CONTENT_SETTING_ALLOW);
  327. EXPECT_EQ(
  328. settings.GetCookieSetting(GURL("chrome://foo") /* url */,
  329. GURL("https://foo.com") /* first_party_url */,
  330. nullptr /* source */, QueryReason::kCookies),
  331. CONTENT_SETTING_BLOCK);
  332. EXPECT_EQ(
  333. settings.GetCookieSetting(GURL("http://foo.com") /* url */,
  334. GURL("chrome://foo") /* first_party_url */,
  335. nullptr /* source */, QueryReason::kCookies),
  336. CONTENT_SETTING_BLOCK);
  337. }
  338. TEST_P(CookieSettingsTest, GetCookieSettingWithThirdPartyCookiesAllowedScheme) {
  339. CookieSettings settings;
  340. settings.set_third_party_cookies_allowed_schemes({"chrome-extension"});
  341. settings.set_block_third_party_cookies(true);
  342. EXPECT_EQ(settings.GetCookieSetting(
  343. GURL("http://foo.com") /* url */,
  344. GURL("chrome-extension://foo") /* first_party_url */,
  345. nullptr /* source */, QueryReason::kCookies),
  346. CONTENT_SETTING_ALLOW);
  347. EXPECT_EQ(settings.GetCookieSetting(
  348. GURL("http://foo.com") /* url */,
  349. GURL("other-scheme://foo") /* first_party_url */,
  350. nullptr /* source */, QueryReason::kCookies),
  351. CONTENT_SETTING_BLOCK);
  352. EXPECT_EQ(
  353. settings.GetCookieSetting(GURL("chrome-extension://foo") /* url */,
  354. GURL("http://foo.com") /* first_party_url */,
  355. nullptr /* source */, QueryReason::kCookies),
  356. CONTENT_SETTING_BLOCK);
  357. }
  358. TEST_P(CookieSettingsTest, GetCookieSettingMatchingSchemeCookiesAllowed) {
  359. CookieSettings settings;
  360. settings.set_matching_scheme_cookies_allowed_schemes({"chrome-extension"});
  361. settings.set_block_third_party_cookies(true);
  362. EXPECT_EQ(settings.GetCookieSetting(
  363. GURL("chrome-extension://bar") /* url */,
  364. GURL("chrome-extension://foo") /* first_party_url */,
  365. nullptr /* source */, QueryReason::kCookies),
  366. CONTENT_SETTING_ALLOW);
  367. EXPECT_EQ(settings.GetCookieSetting(
  368. GURL("http://foo.com") /* url */,
  369. GURL("chrome-extension://foo") /* first_party_url */,
  370. nullptr /* source */, QueryReason::kCookies),
  371. CONTENT_SETTING_BLOCK);
  372. EXPECT_EQ(
  373. settings.GetCookieSetting(GURL("chrome-extension://foo") /* url */,
  374. GURL("http://foo.com") /* first_party_url */,
  375. nullptr /* source */, QueryReason::kCookies),
  376. CONTENT_SETTING_BLOCK);
  377. }
  378. TEST_P(CookieSettingsTest, LegacyCookieAccessDefault) {
  379. CookieSettings settings;
  380. EXPECT_EQ(settings.GetSettingForLegacyCookieAccess(kDomain),
  381. CONTENT_SETTING_BLOCK);
  382. EXPECT_EQ(net::CookieAccessSemantics::NONLEGACY,
  383. settings.GetCookieAccessSemanticsForDomain(kDomain));
  384. }
  385. TEST_P(CookieSettingsTest, CookieAccessSemanticsForDomain) {
  386. CookieSettings settings;
  387. settings.set_content_settings_for_legacy_cookie_access(
  388. {CreateSetting(kDomain, "*", CONTENT_SETTING_ALLOW)});
  389. const struct {
  390. net::CookieAccessSemantics status;
  391. std::string cookie_domain;
  392. } kTestCases[] = {
  393. // These two test cases are LEGACY because they match the setting.
  394. {net::CookieAccessSemantics::LEGACY, kDomain},
  395. {net::CookieAccessSemantics::LEGACY, kDotDomain},
  396. // These two test cases default into NONLEGACY.
  397. // Subdomain does not match pattern.
  398. {net::CookieAccessSemantics::NONLEGACY, kSubDomain},
  399. {net::CookieAccessSemantics::NONLEGACY, kOtherDomain}};
  400. for (const auto& test : kTestCases) {
  401. EXPECT_EQ(test.status,
  402. settings.GetCookieAccessSemanticsForDomain(test.cookie_domain));
  403. }
  404. }
  405. TEST_P(CookieSettingsTest, CookieAccessSemanticsForDomainWithWildcard) {
  406. CookieSettings settings;
  407. settings.set_content_settings_for_legacy_cookie_access(
  408. {CreateSetting(kDomainWildcardPattern, "*", CONTENT_SETTING_ALLOW)});
  409. const struct {
  410. net::CookieAccessSemantics status;
  411. std::string cookie_domain;
  412. } kTestCases[] = {
  413. // These three test cases are LEGACY because they match the setting.
  414. {net::CookieAccessSemantics::LEGACY, kDomain},
  415. {net::CookieAccessSemantics::LEGACY, kDotDomain},
  416. // Subdomain also matches pattern.
  417. {net::CookieAccessSemantics::LEGACY, kSubDomain},
  418. // This test case defaults into NONLEGACY.
  419. {net::CookieAccessSemantics::NONLEGACY, kOtherDomain}};
  420. for (const auto& test : kTestCases) {
  421. EXPECT_EQ(test.status,
  422. settings.GetCookieAccessSemanticsForDomain(test.cookie_domain));
  423. }
  424. }
  425. TEST_P(CookieSettingsTest, IsPrivacyModeEnabled) {
  426. base::HistogramTester histogram_tester;
  427. CookieSettings settings;
  428. settings.set_block_third_party_cookies(true);
  429. // Third-party requests should only have accessed to partitioned state.
  430. EXPECT_EQ(
  431. net::NetworkDelegate::PrivacySetting::kPartitionedStateAllowedOnly,
  432. settings.IsPrivacyModeEnabled(GURL(kURL), net::SiteForCookies(),
  433. url::Origin::Create(GURL(kOtherURL)),
  434. net::SamePartyContext::Type::kCrossParty));
  435. // Same for requests with a null site_for_cookies, even if the
  436. // top_frame_origin matches.
  437. EXPECT_EQ(
  438. net::NetworkDelegate::PrivacySetting::kPartitionedStateAllowedOnly,
  439. settings.IsPrivacyModeEnabled(GURL(kURL), net::SiteForCookies(),
  440. url::Origin::Create(GURL(kURL)),
  441. net::SamePartyContext::Type::kCrossParty));
  442. // The first party is able to send any type of state.
  443. EXPECT_EQ(net::NetworkDelegate::PrivacySetting::kStateAllowed,
  444. settings.IsPrivacyModeEnabled(
  445. GURL(kURL), net::SiteForCookies::FromUrl(GURL(kURL)),
  446. url::Origin::Create(GURL(kURL)),
  447. net::SamePartyContext::Type::kSameParty));
  448. // Setting a site-specific rule for the top-level frame origin that blocks
  449. // access should cause partitioned state to be disallowed.
  450. settings.set_content_settings(
  451. {CreateSetting(kOtherURL, "*", CONTENT_SETTING_BLOCK)});
  452. EXPECT_EQ(
  453. net::NetworkDelegate::PrivacySetting::kStateDisallowed,
  454. settings.IsPrivacyModeEnabled(GURL(kURL), net::SiteForCookies(),
  455. url::Origin::Create(GURL(kOtherURL)),
  456. net::SamePartyContext::Type::kCrossParty));
  457. // Setting a site-specific rule for the top-level frame origin when it is
  458. // embedded on an unrelated site should not affect if partitioned state is
  459. // allowed.
  460. settings.set_content_settings(
  461. {CreateSetting(kOtherURL, kUnrelatedURL, CONTENT_SETTING_BLOCK)});
  462. EXPECT_EQ(
  463. net::NetworkDelegate::PrivacySetting::kPartitionedStateAllowedOnly,
  464. settings.IsPrivacyModeEnabled(GURL(kURL), net::SiteForCookies(),
  465. url::Origin::Create(GURL(kOtherURL)),
  466. net::SamePartyContext::Type::kCrossParty));
  467. // No state is allowed if there's a site-specific rule that blocks access,
  468. // regardless of the kind of request.
  469. settings.set_content_settings(
  470. {CreateSetting(kURL, "*", CONTENT_SETTING_BLOCK)});
  471. // Third-party requests:
  472. EXPECT_EQ(
  473. net::NetworkDelegate::PrivacySetting::kStateDisallowed,
  474. settings.IsPrivacyModeEnabled(GURL(kURL), net::SiteForCookies(),
  475. url::Origin::Create(GURL(kOtherURL)),
  476. net::SamePartyContext::Type::kCrossParty));
  477. // Requests with a null site_for_cookies, but matching top_frame_origin.
  478. EXPECT_EQ(
  479. net::NetworkDelegate::PrivacySetting::kStateDisallowed,
  480. settings.IsPrivacyModeEnabled(GURL(kURL), net::SiteForCookies(),
  481. url::Origin::Create(GURL(kURL)),
  482. net::SamePartyContext::Type::kCrossParty));
  483. // First-party requests.
  484. EXPECT_EQ(net::NetworkDelegate::PrivacySetting::kStateDisallowed,
  485. settings.IsPrivacyModeEnabled(
  486. GURL(kURL), net::SiteForCookies::FromUrl(GURL(kURL)),
  487. url::Origin::Create(GURL(kURL)),
  488. net::SamePartyContext::Type::kSameParty));
  489. // No histogram samples should have been recorded.
  490. EXPECT_THAT(histogram_tester.GetAllSamples(
  491. "Cookie.SameParty.BlockedByThirdPartyCookieBlockingSetting"),
  492. IsEmpty());
  493. }
  494. class SamePartyCookieSettingsTest : public CookieSettingsTest {
  495. public:
  496. SamePartyCookieSettingsTest() {
  497. features_.InitAndEnableFeature(
  498. net::features::kSamePartyCookiesConsideredFirstParty);
  499. }
  500. private:
  501. base::test::ScopedFeatureList features_;
  502. };
  503. TEST_P(SamePartyCookieSettingsTest, IsPrivacyModeEnabled) {
  504. base::HistogramTester histogram_tester;
  505. CookieSettings settings;
  506. settings.set_block_third_party_cookies(true);
  507. // Enabled for cross-party requests.
  508. EXPECT_EQ(
  509. net::NetworkDelegate::PrivacySetting::kPartitionedStateAllowedOnly,
  510. settings.IsPrivacyModeEnabled(GURL(kFPSMemberURL), net::SiteForCookies(),
  511. url::Origin::Create(GURL(kFPSOwnerURL)),
  512. net::SamePartyContext::Type::kCrossParty));
  513. // Disabled for cross-site, same-party requests.
  514. EXPECT_EQ(
  515. net::NetworkDelegate::PrivacySetting::kStateAllowed,
  516. settings.IsPrivacyModeEnabled(GURL(kFPSMemberURL), net::SiteForCookies(),
  517. url::Origin::Create(GURL(kFPSOwnerURL)),
  518. net::SamePartyContext::Type::kSameParty));
  519. // Enabled for same-party requests if blocked by a site-specific rule.
  520. settings.set_content_settings(
  521. {CreateSetting(kFPSMemberURL, "*", CONTENT_SETTING_BLOCK)});
  522. EXPECT_EQ(
  523. net::NetworkDelegate::PrivacySetting::kStateDisallowed,
  524. settings.IsPrivacyModeEnabled(GURL(kFPSMemberURL), net::SiteForCookies(),
  525. url::Origin::Create(GURL(kFPSOwnerURL)),
  526. net::SamePartyContext::Type::kSameParty));
  527. // No histogram samples should have been recorded.
  528. EXPECT_THAT(histogram_tester.GetAllSamples(
  529. "Cookie.SameParty.BlockedByThirdPartyCookieBlockingSetting"),
  530. IsEmpty());
  531. }
  532. TEST_P(CookieSettingsTest, IsCookieAccessible) {
  533. base::HistogramTester histogram_tester;
  534. CookieSettings settings;
  535. settings.set_block_third_party_cookies(true);
  536. // Third-party cookies are blocked, the cookie should not be accessible.
  537. std::unique_ptr<net::CanonicalCookie> non_sameparty_cookie =
  538. MakeCanonicalCookie("name", kFPSMemberURL, false /* sameparty */);
  539. EXPECT_FALSE(settings.IsCookieAccessible(
  540. *non_sameparty_cookie, GURL(kFPSMemberURL), net::SiteForCookies(),
  541. url::Origin::Create(GURL(kFPSOwnerURL))));
  542. EXPECT_THAT(histogram_tester.GetAllSamples(
  543. "Cookie.SameParty.BlockedByThirdPartyCookieBlockingSetting"),
  544. IsEmpty());
  545. // SameParty cookies are not considered first-party, so they should be
  546. // inaccessible in cross-site contexts.
  547. std::unique_ptr<net::CanonicalCookie> sameparty_cookie =
  548. MakeCanonicalCookie("name", kFPSMemberURL, true /* sameparty */);
  549. EXPECT_FALSE(settings.IsCookieAccessible(
  550. *sameparty_cookie, GURL(kFPSMemberURL), net::SiteForCookies(),
  551. url::Origin::Create(GURL(kFPSOwnerURL))));
  552. EXPECT_THAT(histogram_tester.GetAllSamples(
  553. "Cookie.SameParty.BlockedByThirdPartyCookieBlockingSetting"),
  554. ElementsAre(base::Bucket(/*min=*/1, /*count=*/1)));
  555. // If the SameParty cookie is blocked by a site-specific setting, it should
  556. // still be inaccessible.
  557. settings.set_content_settings(
  558. {CreateSetting(kFPSMemberURL, "*", CONTENT_SETTING_BLOCK)});
  559. EXPECT_FALSE(settings.IsCookieAccessible(
  560. *sameparty_cookie, GURL(kFPSMemberURL), net::SiteForCookies(),
  561. url::Origin::Create(GURL(kFPSOwnerURL))));
  562. // It wasn't the third-party cookie blocking setting this time, so we don't
  563. // record the metric.
  564. EXPECT_THAT(histogram_tester.GetAllSamples(
  565. "Cookie.SameParty.BlockedByThirdPartyCookieBlockingSetting"),
  566. ElementsAre(base::Bucket(/*min=*/1, /*count=*/1)));
  567. }
  568. TEST_P(SamePartyCookieSettingsTest, IsCookieAccessible) {
  569. base::HistogramTester histogram_tester;
  570. CookieSettings settings;
  571. settings.set_block_third_party_cookies(true);
  572. // Third-party cookies are blocked, the cookie should not be accessible.
  573. std::unique_ptr<net::CanonicalCookie> non_sameparty_cookie =
  574. MakeCanonicalCookie("name", kFPSMemberURL, false /* sameparty */);
  575. EXPECT_FALSE(settings.IsCookieAccessible(
  576. *non_sameparty_cookie, GURL(kFPSMemberURL), net::SiteForCookies(),
  577. url::Origin::Create(GURL(kFPSOwnerURL))));
  578. EXPECT_THAT(histogram_tester.GetAllSamples(
  579. "Cookie.SameParty.BlockedByThirdPartyCookieBlockingSetting"),
  580. IsEmpty());
  581. // SameParty cookies are considered first-party, so they should be accessible,
  582. // even in cross-site contexts.
  583. std::unique_ptr<net::CanonicalCookie> sameparty_cookie =
  584. MakeCanonicalCookie("name", kFPSMemberURL, true /* sameparty */);
  585. EXPECT_TRUE(settings.IsCookieAccessible(
  586. *sameparty_cookie, GURL(kFPSMemberURL), net::SiteForCookies(),
  587. url::Origin::Create(GURL(kFPSOwnerURL))));
  588. EXPECT_THAT(histogram_tester.GetAllSamples(
  589. "Cookie.SameParty.BlockedByThirdPartyCookieBlockingSetting"),
  590. ElementsAre(base::Bucket(/*min=*/0, /*count=*/1)));
  591. // If the SameParty cookie is blocked by a site-specific setting, it should
  592. // not be accessible.
  593. settings.set_content_settings(
  594. {CreateSetting(kFPSMemberURL, "*", CONTENT_SETTING_BLOCK)});
  595. EXPECT_FALSE(settings.IsCookieAccessible(
  596. *sameparty_cookie, GURL(kFPSMemberURL), net::SiteForCookies(),
  597. url::Origin::Create(GURL(kFPSOwnerURL))));
  598. // It wasn't blocked by third-party cookie blocking settings, so we shouldn't
  599. // record the metric.
  600. EXPECT_THAT(histogram_tester.GetAllSamples(
  601. "Cookie.SameParty.BlockedByThirdPartyCookieBlockingSetting"),
  602. ElementsAre(base::Bucket(/*min=*/0, /*count=*/1)));
  603. // If the SameParty cookie is blocked by the global default setting (i.e. if
  604. // the user has blocked all cookies), it should not be accessible.
  605. settings.set_content_settings(
  606. {CreateSetting("*", "*", CONTENT_SETTING_BLOCK)});
  607. EXPECT_FALSE(settings.IsCookieAccessible(
  608. *sameparty_cookie, GURL(kFPSMemberURL), net::SiteForCookies(),
  609. url::Origin::Create(GURL(kFPSOwnerURL))));
  610. // It wasn't blocked by third-party cookie blocking settings, so we shouldn't
  611. // record the metric.
  612. EXPECT_THAT(histogram_tester.GetAllSamples(
  613. "Cookie.SameParty.BlockedByThirdPartyCookieBlockingSetting"),
  614. ElementsAre(base::Bucket(/*min=*/0, /*count=*/1)));
  615. }
  616. TEST_P(CookieSettingsTest, IsCookieAccessible_PartitionedCookies) {
  617. CookieSettings settings;
  618. settings.set_block_third_party_cookies(true);
  619. std::unique_ptr<net::CanonicalCookie> unpartitioned_cookie =
  620. MakeCanonicalCookie("unpartitioned", kURL, false /* sameparty */,
  621. absl::nullopt /* cookie_partition_key */);
  622. EXPECT_FALSE(settings.IsCookieAccessible(
  623. *unpartitioned_cookie, GURL(kURL), net::SiteForCookies(),
  624. url::Origin::Create(GURL(kOtherURL))));
  625. std::unique_ptr<net::CanonicalCookie> partitioned_cookie =
  626. MakeCanonicalCookie(
  627. "__Host-partitioned", kURL, false /* sameparty */,
  628. net::CookiePartitionKey::FromURLForTesting(GURL(kOtherURL)));
  629. EXPECT_TRUE(settings.IsCookieAccessible(
  630. *partitioned_cookie, GURL(kURL), net::SiteForCookies(),
  631. url::Origin::Create(GURL(kOtherURL))));
  632. // If there is a site-specific content setting blocking cookies, then
  633. // partitioned cookies should not be available.
  634. settings.set_block_third_party_cookies(false);
  635. settings.set_content_settings(
  636. {CreateSetting(kURL, "*", CONTENT_SETTING_BLOCK)});
  637. EXPECT_FALSE(settings.IsCookieAccessible(
  638. *partitioned_cookie, GURL(kURL), net::SiteForCookies(),
  639. url::Origin::Create(GURL(kOtherURL))));
  640. // If third-party cookie blocking is enabled and there is a site-specific
  641. // content setting blocking the top-frame origin's own cookies, then
  642. // the partitioned cookie should not be allowed.
  643. settings.set_block_third_party_cookies(true);
  644. settings.set_content_settings(
  645. {CreateSetting(kOtherURL, "*", CONTENT_SETTING_BLOCK)});
  646. EXPECT_FALSE(settings.IsCookieAccessible(
  647. *partitioned_cookie, GURL(kURL), net::SiteForCookies(),
  648. url::Origin::Create(GURL(kOtherURL))));
  649. // If third-party cookie blocking is enabled and there is a site-specific
  650. // setting for the top-frame origin that only applies on an unrelated site,
  651. // then the partitioned cookie should still be allowed.
  652. settings.set_content_settings(
  653. {CreateSetting(kOtherURL, kUnrelatedURL, CONTENT_SETTING_BLOCK)});
  654. EXPECT_TRUE(settings.IsCookieAccessible(
  655. *partitioned_cookie, GURL(kURL), net::SiteForCookies(),
  656. url::Origin::Create(GURL(kOtherURL))));
  657. // If third-party cookie blocking is enabled and there is a matching Storage
  658. // Access setting whose value is BLOCK, then the partitioned cookie should
  659. // still be allowed.
  660. settings.set_block_third_party_cookies(true);
  661. settings.set_content_settings(
  662. {CreateSetting(kURL, kURL, CONTENT_SETTING_ALLOW)});
  663. settings.set_storage_access_grants(
  664. {CreateSetting(kURL, kOtherURL, CONTENT_SETTING_BLOCK)});
  665. EXPECT_TRUE(settings.IsCookieAccessible(
  666. *partitioned_cookie, GURL(kURL), net::SiteForCookies(),
  667. url::Origin::Create(GURL(kOtherURL))));
  668. }
  669. TEST_P(CookieSettingsTest, AnnotateAndMoveUserBlockedCookies) {
  670. base::HistogramTester histogram_tester;
  671. CookieSettings settings;
  672. settings.set_block_third_party_cookies(true);
  673. net::CookieAccessResultList maybe_included_cookies = {
  674. {*MakeCanonicalCookie("third_party", kOtherURL, false /* sameparty */),
  675. {}},
  676. {*MakeCanonicalCookie("first_party", kURL, true /* sameparty */), {}}};
  677. net::CookieAccessResultList excluded_cookies = {
  678. {*MakeCanonicalCookie("excluded_other", kURL, false /* sameparty */),
  679. // The ExclusionReason below is irrelevant, as long as there is
  680. // one.
  681. net::CookieAccessResult(net::CookieInclusionStatus(
  682. net::CookieInclusionStatus::ExclusionReason::EXCLUDE_SECURE_ONLY))}};
  683. url::Origin origin = url::Origin::Create(GURL(kURL));
  684. EXPECT_FALSE(settings.AnnotateAndMoveUserBlockedCookies(
  685. GURL(kURL), net::SiteForCookies(), &origin, maybe_included_cookies,
  686. excluded_cookies));
  687. EXPECT_THAT(maybe_included_cookies, IsEmpty());
  688. EXPECT_THAT(
  689. excluded_cookies,
  690. UnorderedElementsAre(
  691. MatchesCookieWithAccessResult(
  692. net::MatchesCookieWithName("first_party"),
  693. MatchesCookieAccessResult(
  694. HasExactlyExclusionReasonsForTesting(
  695. std::vector<net::CookieInclusionStatus::ExclusionReason>{
  696. net::CookieInclusionStatus::ExclusionReason::
  697. EXCLUDE_USER_PREFERENCES}),
  698. _, _, _)),
  699. MatchesCookieWithAccessResult(
  700. net::MatchesCookieWithName("excluded_other"),
  701. MatchesCookieAccessResult(
  702. HasExactlyExclusionReasonsForTesting(
  703. std::vector<net::CookieInclusionStatus::ExclusionReason>{
  704. net::CookieInclusionStatus::ExclusionReason::
  705. EXCLUDE_SECURE_ONLY,
  706. net::CookieInclusionStatus::ExclusionReason::
  707. EXCLUDE_USER_PREFERENCES}),
  708. _, _, _)),
  709. MatchesCookieWithAccessResult(
  710. net::MatchesCookieWithName("third_party"),
  711. MatchesCookieAccessResult(
  712. HasExactlyExclusionReasonsForTesting(
  713. std::vector<net::CookieInclusionStatus::ExclusionReason>{
  714. net::CookieInclusionStatus::ExclusionReason::
  715. EXCLUDE_USER_PREFERENCES}),
  716. _, _, _))));
  717. // One SameParty cookie was blocked due to 3P cookie blocking settings.
  718. EXPECT_THAT(histogram_tester.GetAllSamples(
  719. "Cookie.SameParty.BlockedByThirdPartyCookieBlockingSetting"),
  720. ElementsAre(base::Bucket(/*min=*/1, /*count=*/1)));
  721. }
  722. TEST_P(SamePartyCookieSettingsTest, AnnotateAndMoveUserBlockedCookies) {
  723. base::HistogramTester histogram_tester;
  724. CookieSettings settings;
  725. settings.set_block_third_party_cookies(true);
  726. net::CookieAccessResultList maybe_included_cookies = {
  727. {*MakeCanonicalCookie("included_third_party", kFPSMemberURL,
  728. false /* sameparty */),
  729. {}},
  730. {*MakeCanonicalCookie("included_sameparty", kFPSMemberURL,
  731. true /* sameparty */),
  732. {}}};
  733. // The following exclusion reasons don't make sense when taken together;
  734. // they're just to exercise the SUT.
  735. net::CookieAccessResultList excluded_cookies = {
  736. {*MakeCanonicalCookie("excluded_other", kFPSMemberURL,
  737. false /* sameparty */),
  738. net::CookieAccessResult(net::CookieInclusionStatus(
  739. net::CookieInclusionStatus::ExclusionReason::EXCLUDE_SECURE_ONLY))},
  740. {*MakeCanonicalCookie("excluded_invalid_sameparty", kFPSMemberURL,
  741. true /* sameparty */),
  742. net::CookieAccessResult(net::CookieInclusionStatus(
  743. net::CookieInclusionStatus::ExclusionReason::
  744. EXCLUDE_SAMEPARTY_CROSS_PARTY_CONTEXT))},
  745. {*MakeCanonicalCookie("excluded_valid_sameparty", kFPSMemberURL,
  746. true /* sameparty */),
  747. net::CookieAccessResult(net::CookieInclusionStatus(
  748. net::CookieInclusionStatus::ExclusionReason::EXCLUDE_SECURE_ONLY))}};
  749. const url::Origin fps_owner_origin = url::Origin::Create(GURL(kFPSOwnerURL));
  750. EXPECT_TRUE(settings.AnnotateAndMoveUserBlockedCookies(
  751. GURL(kFPSMemberURL), net::SiteForCookies(), &fps_owner_origin,
  752. maybe_included_cookies, excluded_cookies));
  753. EXPECT_THAT(maybe_included_cookies,
  754. ElementsAre(MatchesCookieWithAccessResult(
  755. net::MatchesCookieWithName("included_sameparty"),
  756. MatchesCookieAccessResult(net::IsInclude(), _, _, _))));
  757. EXPECT_THAT(
  758. excluded_cookies,
  759. UnorderedElementsAre(
  760. MatchesCookieWithAccessResult(
  761. net::MatchesCookieWithName("included_third_party"),
  762. MatchesCookieAccessResult(
  763. HasExactlyExclusionReasonsForTesting(
  764. std::vector<net::CookieInclusionStatus::ExclusionReason>{
  765. net::CookieInclusionStatus::ExclusionReason::
  766. EXCLUDE_USER_PREFERENCES}),
  767. _, _, _)),
  768. MatchesCookieWithAccessResult(
  769. net::MatchesCookieWithName("excluded_other"),
  770. MatchesCookieAccessResult(
  771. HasExactlyExclusionReasonsForTesting(
  772. std::vector<net::CookieInclusionStatus::ExclusionReason>{
  773. net::CookieInclusionStatus::ExclusionReason::
  774. EXCLUDE_SECURE_ONLY,
  775. net::CookieInclusionStatus::ExclusionReason::
  776. EXCLUDE_USER_PREFERENCES}),
  777. _, _, _)),
  778. MatchesCookieWithAccessResult(
  779. net::MatchesCookieWithName("excluded_invalid_sameparty"),
  780. MatchesCookieAccessResult(
  781. HasExactlyExclusionReasonsForTesting(
  782. std::vector<net::CookieInclusionStatus::ExclusionReason>{
  783. net::CookieInclusionStatus::ExclusionReason::
  784. EXCLUDE_SAMEPARTY_CROSS_PARTY_CONTEXT,
  785. net::CookieInclusionStatus::ExclusionReason::
  786. EXCLUDE_USER_PREFERENCES}),
  787. _, _, _)),
  788. MatchesCookieWithAccessResult(
  789. net::MatchesCookieWithName("excluded_valid_sameparty"),
  790. MatchesCookieAccessResult(
  791. HasExactlyExclusionReasonsForTesting(
  792. std::vector<net::CookieInclusionStatus::ExclusionReason>{
  793. net::CookieInclusionStatus::ExclusionReason::
  794. EXCLUDE_SECURE_ONLY}),
  795. _, _, _))));
  796. // 2 SameParty cookies were allowed (by user's settings, not by the cookie
  797. // store), despite 3P cookie blocking being enabled. Note that
  798. // `excluded_invalid_sameparty` is not in a same-party context, so we do not
  799. // record metrics for it.
  800. EXPECT_THAT(histogram_tester.GetAllSamples(
  801. "Cookie.SameParty.BlockedByThirdPartyCookieBlockingSetting"),
  802. ElementsAre(base::Bucket(/*min=*/0, /*count=*/2)));
  803. }
  804. namespace {
  805. net::CookieAccessResultList MakeUnpartitionedAndPartitionedCookies() {
  806. return {
  807. {*MakeCanonicalCookie("unpartitioned", kURL, false /* sameparty */), {}},
  808. {*MakeCanonicalCookie(
  809. "__Host-partitioned", kURL, false /* sameparty */,
  810. net::CookiePartitionKey::FromURLForTesting(GURL(kOtherURL))),
  811. {}},
  812. };
  813. }
  814. } // namespace
  815. TEST_P(CookieSettingsTest,
  816. AnnotateAndMoveUserBlockedCookies_PartitionedCookies) {
  817. CookieSettings settings;
  818. net::CookieAccessResultList maybe_included_cookies =
  819. MakeUnpartitionedAndPartitionedCookies();
  820. net::CookieAccessResultList excluded_cookies = {};
  821. url::Origin top_level_origin = url::Origin::Create(GURL(kOtherURL));
  822. // If 3PC blocking is enabled and there are no site-specific content settings
  823. // then partitioned cookies should be allowed.
  824. settings.set_block_third_party_cookies(true);
  825. EXPECT_TRUE(settings.AnnotateAndMoveUserBlockedCookies(
  826. GURL(kURL), net::SiteForCookies(), &top_level_origin,
  827. maybe_included_cookies, excluded_cookies));
  828. EXPECT_THAT(maybe_included_cookies,
  829. ElementsAre(MatchesCookieWithAccessResult(
  830. net::MatchesCookieWithName("__Host-partitioned"),
  831. MatchesCookieAccessResult(net::IsInclude(), _, _, _))));
  832. EXPECT_THAT(excluded_cookies,
  833. ElementsAre(MatchesCookieWithAccessResult(
  834. net::MatchesCookieWithName("unpartitioned"),
  835. MatchesCookieAccessResult(
  836. net::HasExclusionReason(
  837. net::CookieInclusionStatus::EXCLUDE_USER_PREFERENCES),
  838. _, _, _))));
  839. // If there is a site-specific content setting blocking cookies, then
  840. // partitioned cookies should not be allowed.
  841. maybe_included_cookies = MakeUnpartitionedAndPartitionedCookies();
  842. excluded_cookies = {};
  843. settings.set_block_third_party_cookies(false);
  844. settings.set_content_settings(
  845. {CreateSetting(kURL, "*", CONTENT_SETTING_BLOCK)});
  846. EXPECT_FALSE(settings.AnnotateAndMoveUserBlockedCookies(
  847. GURL(kURL), net::SiteForCookies(), &top_level_origin,
  848. maybe_included_cookies, excluded_cookies));
  849. EXPECT_THAT(maybe_included_cookies, IsEmpty());
  850. EXPECT_THAT(
  851. excluded_cookies,
  852. UnorderedElementsAre(
  853. MatchesCookieWithAccessResult(
  854. net::MatchesCookieWithName("__Host-partitioned"),
  855. MatchesCookieAccessResult(
  856. net::HasExclusionReason(
  857. net::CookieInclusionStatus::EXCLUDE_USER_PREFERENCES),
  858. _, _, _)),
  859. MatchesCookieWithAccessResult(
  860. net::MatchesCookieWithName("unpartitioned"),
  861. MatchesCookieAccessResult(
  862. net::HasExclusionReason(
  863. net::CookieInclusionStatus::EXCLUDE_USER_PREFERENCES),
  864. _, _, _))));
  865. // If there is a site-specific content setting blocking cookies on the
  866. // current top-level origin, then partitioned cookies should not be allowed.
  867. maybe_included_cookies = MakeUnpartitionedAndPartitionedCookies();
  868. excluded_cookies = {};
  869. settings.set_block_third_party_cookies(true);
  870. settings.set_content_settings(
  871. {CreateSetting(kOtherURL, "*", CONTENT_SETTING_BLOCK)});
  872. EXPECT_FALSE(settings.AnnotateAndMoveUserBlockedCookies(
  873. GURL(kURL), net::SiteForCookies(), &top_level_origin,
  874. maybe_included_cookies, excluded_cookies));
  875. EXPECT_THAT(maybe_included_cookies, IsEmpty());
  876. EXPECT_THAT(
  877. excluded_cookies,
  878. UnorderedElementsAre(
  879. MatchesCookieWithAccessResult(
  880. net::MatchesCookieWithName("__Host-partitioned"),
  881. MatchesCookieAccessResult(
  882. net::HasExclusionReason(
  883. net::CookieInclusionStatus::EXCLUDE_USER_PREFERENCES),
  884. _, _, _)),
  885. MatchesCookieWithAccessResult(
  886. net::MatchesCookieWithName("unpartitioned"),
  887. MatchesCookieAccessResult(
  888. net::HasExclusionReason(
  889. net::CookieInclusionStatus::EXCLUDE_USER_PREFERENCES),
  890. _, _, _))));
  891. // If there is a site-specific content setting blocking cookies on the
  892. // current top-level origin but only when it is embedded on an unrelated site,
  893. // then partitioned cookies should still be allowed.
  894. maybe_included_cookies = MakeUnpartitionedAndPartitionedCookies();
  895. excluded_cookies = {};
  896. settings.set_block_third_party_cookies(true);
  897. settings.set_content_settings(
  898. {CreateSetting(kOtherURL, kUnrelatedURL, CONTENT_SETTING_BLOCK)});
  899. EXPECT_TRUE(settings.AnnotateAndMoveUserBlockedCookies(
  900. GURL(kURL), net::SiteForCookies(), &top_level_origin,
  901. maybe_included_cookies, excluded_cookies));
  902. EXPECT_THAT(maybe_included_cookies,
  903. ElementsAre(MatchesCookieWithAccessResult(
  904. net::MatchesCookieWithName("__Host-partitioned"),
  905. MatchesCookieAccessResult(net::IsInclude(), _, _, _))));
  906. EXPECT_THAT(excluded_cookies,
  907. ElementsAre(MatchesCookieWithAccessResult(
  908. net::MatchesCookieWithName("unpartitioned"),
  909. MatchesCookieAccessResult(
  910. net::HasExclusionReason(
  911. net::CookieInclusionStatus::EXCLUDE_USER_PREFERENCES),
  912. _, _, _))));
  913. }
  914. INSTANTIATE_TEST_SUITE_P(/* no prefix */, CookieSettingsTest, testing::Bool());
  915. INSTANTIATE_TEST_SUITE_P(/* no prefix */,
  916. SamePartyCookieSettingsTest,
  917. testing::Bool());
  918. } // namespace
  919. } // namespace network