From 6759f84ccf3dc1d0d48ae6ede4da53556ae3f623 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicol=C3=A1s=20Pe=C3=B1a?= Date: Wed, 15 Nov 2023 12:45:59 -0800 Subject: [PATCH] [FedCM] Revoke at least one account after sending IDP request MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If an invalid account hint is sent, the user agent should still revoke an existing sharing permission. This guarantees that revoke() cannot be repeatedly called while sending a credentialed request to the IDP each time. We also remove a comment about the FedCM settings, as it has been decided that the FedCM setting should affect revoke() as well. Bug: 1473134, 1495108 Change-Id: I65154c049fa7811b6507d3054678ae718916e7ab Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5019345 Commit-Queue: Nicolás Peña Reviewed-by: danakj Cr-Commit-Position: refs/heads/main@{#1225125} --- credential-management/fedcm-revoke.https.html | 37 --------- .../fedcm-revoke.sub.https.html | 81 +++++++++++++++++++ .../support/fedcm-helper.sub.js | 13 +++ credential-management/support/fedcm/revoke.py | 9 ++- .../support/set_cookie.headers | 2 +- 5 files changed, 100 insertions(+), 42 deletions(-) delete mode 100644 credential-management/fedcm-revoke.https.html create mode 100644 credential-management/fedcm-revoke.sub.https.html diff --git a/credential-management/fedcm-revoke.https.html b/credential-management/fedcm-revoke.https.html deleted file mode 100644 index fb631978af6440..00000000000000 --- a/credential-management/fedcm-revoke.https.html +++ /dev/null @@ -1,37 +0,0 @@ - -Federated Credential Management API revoke() tests. - - - - - - - - - diff --git a/credential-management/fedcm-revoke.sub.https.html b/credential-management/fedcm-revoke.sub.https.html new file mode 100644 index 00000000000000..b16c0162de3ac7 --- /dev/null +++ b/credential-management/fedcm-revoke.sub.https.html @@ -0,0 +1,81 @@ + +Federated Credential Management API revoke() tests. + + + + + + + + + diff --git a/credential-management/support/fedcm-helper.sub.js b/credential-management/support/fedcm-helper.sub.js index 319dc08c35066a..8c3a52c5b2291e 100644 --- a/credential-management/support/fedcm-helper.sub.js +++ b/credential-management/support/fedcm-helper.sub.js @@ -225,3 +225,16 @@ credential-management/support/fedcm/${manifest_filename}`; accountHint: accountHint }; } + +export function alt_revoke_options(accountHint, manifest_filename) { + if (manifest_filename === undefined) { + manifest_filename = "manifest.py"; + } + const manifest_path = `${alt_manifest_origin}/\ +credential-management/support/fedcm/${manifest_filename}`; + return { + configURL: manifest_path, + clientId: '1', + accountHint: accountHint + }; +} diff --git a/credential-management/support/fedcm/revoke.py b/credential-management/support/fedcm/revoke.py index 3b06526353ce28..cf62ceda22515d 100644 --- a/credential-management/support/fedcm/revoke.py +++ b/credential-management/support/fedcm/revoke.py @@ -2,12 +2,13 @@ error_checker = importlib.import_module("credential-management.support.fedcm.request-params-check") def main(request, response): + response.headers.set(b"Content-Type", b"application/json") + response.headers.set(b"Access-Control-Allow-Origin", request.headers.get(b"origin")) + response.headers.set(b"Access-Control-Allow-Credentials", b"true") request_error = error_checker.revokeCheck(request) - if (request_error): + if request_error: return request_error - response.headers.set(b"Content-Type", b"application/json") - # Pass the account_hint as the accountId. - account_hint = request.POST.get(b"account_hint"); + account_hint = request.POST.get(b"account_hint") return f"{{\"account_id\": \"{account_hint}\"}}" diff --git a/credential-management/support/set_cookie.headers b/credential-management/support/set_cookie.headers index cf5ea7fff914af..b19ff933a6f585 100644 --- a/credential-management/support/set_cookie.headers +++ b/credential-management/support/set_cookie.headers @@ -1,2 +1,2 @@ Content-Type: text/html -Set-Cookie: cookie=1; SameSite=Strict; Secure +Set-Cookie: cookie=1; SameSite=None; Secure