46 lines
1.8 KiB
HTML
46 lines
1.8 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<title>Resource Timing TAO - "null" and opaque origin</title>
|
|
<link rel="author" title="Google" href="http://www.google.com/" />
|
|
<link rel="help" href="https://www.w3.org/TR/resource-timing-2/#timing-allow-origin"/>
|
|
<script src="/resources/testharness.js"></script>
|
|
<script src="/resources/testharnessreport.js"></script>
|
|
<script src="/common/get-host-info.sub.js"></script>
|
|
</head>
|
|
<body>
|
|
<h1>Description</h1>
|
|
<p>This test validates that, for a cross origin resource, the timing allow
|
|
check algorithm will correctly distinguish between 'null' and 'Null' values in
|
|
the Timing-Allow-Origin header. An opaque origin's serialization is the string
|
|
"null" and the timing allow origin check needs to do a case-sensitive comparison
|
|
to the Timing-Allow-Origin header.
|
|
</p>
|
|
<iframe id="frameContext"></iframe>
|
|
<script>
|
|
const {ORIGIN} = get_host_info();
|
|
const url = `${ORIGIN}/resource-timing/resources/TAOResponse.py`;
|
|
const frame_content = `data:text/html;utf8,<body>
|
|
<script src="${ORIGIN}/resources/testharness.js"></` + `script>
|
|
<script src="${ORIGIN}/resource-timing/resources/entry-invariants.js">
|
|
</` + `script>
|
|
<script>
|
|
attribute_test(fetch, "${url}?tao=null",
|
|
invariants.assert_tao_pass_no_redirect_http,
|
|
"An opaque origin should be authorized to see resource timings when the" +
|
|
"TAO header is the string 'null'");
|
|
attribute_test(fetch, "${url}?tao=Null",
|
|
invariants.assert_tao_failure_resource,
|
|
"An opaque origin must not be authorized to see resource timings when " +
|
|
"the TAO header is the string 'Null'. (The check for 'null' must be " +
|
|
"case-sensitive)");
|
|
</` + `script>
|
|
</body>`;
|
|
|
|
frameContext.style = "display:none";
|
|
frameContext.src = frame_content;
|
|
fetch_tests_from_window(frameContext.contentWindow);
|
|
</script>
|
|
</body>
|
|
</html>
|