WPT
wpt / digital-credentials / get-opaque-origin-combinations.https.html
Spec: https://github.com/w3c-fedid/digital-credentials/ ↗
Runs: Chrome 155.0.8039.0 (wpt@6ec9fd59f, 2026-09-03) | Firefox 157.0a1 (wpt@6ec9fd59f, 2026-09-03) | Safari 251 preview (wpt@5ce815a83, 2026-08-27) | Ladybird 1.0-795e1 (wpt@7e3d005d7, 2026-09-03) | Servo Servo 0.6 (wpt@09159dcb3, 2026-09-02) | Blitz 188486089 (wpt@a95401e4e, 2026-09-02)
View on the Blitz WPT dashboard | Open test on wpt.live | wpt.fyi
| Chrome | Firefox | Safari | Ladybird | Servo | Blitz | |
|---|---|---|---|---|---|---|
| Total | 5/13 | 3/13 | 13/13 | 3/13 | 3/13 | NOT RUN |
| Subtest | Chrome | Firefox | Safari | Ladybird | Servo | Blitz |
|---|---|---|---|---|---|---|
| get() from an opaque origin (sandboxed iframe) rejects with SecurityError | FAIL | FAIL | PASS | FAIL | FAIL | — |
| get() from an opaque origin (sandboxed srcdoc iframe) rejects with SecurityError | FAIL | FAIL | PASS | FAIL | FAIL | — |
| get() from an opaque origin (iframe whose document has a Content-Security-Policy: sandbox header) rejects with SecurityError | FAIL | FAIL | PASS | FAIL | FAIL | — |
| get() from an opaque origin (plain iframe nested inside a sandboxed iframe (2 levels)) rejects with SecurityError | FAIL | FAIL | PASS | FAIL | FAIL | — |
| get() from an opaque origin (plain iframes nested two deep inside a sandboxed iframe (3 levels)) rejects with SecurityError | FAIL | FAIL | PASS | FAIL | FAIL | — |
| get() from an opaque origin (allow-same-origin iframe nested inside a sandboxed iframe) rejects with SecurityError | FAIL | FAIL | PASS | FAIL | FAIL | — |
| get() from an opaque origin (plain iframe nested inside a Content-Security-Policy: sandbox document (CSP-derived flags propagate)) rejects with SecurityError | FAIL | FAIL | PASS | FAIL | FAIL | — |
| get() from an opaque origin (allow-same-origin iframe nested inside a Content-Security-Policy: sandbox document (cannot escape)) rejects with SecurityError | FAIL | FAIL | PASS | FAIL | FAIL | — |
| get() from a non-opaque origin (sandboxed iframe with allow-same-origin) is not rejected as opaque | PASS | PASS | PASS | PASS | PASS | — |
| get() from a non-opaque origin (srcdoc iframe without sandbox (inherits the parent origin)) is not rejected as opaque | PASS | PASS | PASS | PASS | PASS | — |
| get() from a non-opaque origin (blob: iframe (inherits the creator origin)) is not rejected as opaque | PASS | PASS | PASS | PASS | PASS | — |
| get() in a data: iframe is unavailable (not a secure context) and never reaches the opaque-origin check | PASS | FAIL | PASS | FAIL | FAIL | — |
| get() in a blob: iframe created inside a sandboxed frame inherits the opaque origin and is unavailable | PASS | FAIL | PASS | TIMEOUT | TIMEOUT | — |