forked from LeenkxTeam/Kmake
47 lines
2.0 KiB
HTML
47 lines
2.0 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<title>TAO - port mismatch must fail the check</title>
|
|
<link rel="author" title="Google" href="http://www.google.com/" />
|
|
<link rel="help" href="https://www.w3.org/TR/resource-timing-2/#sec-timing-allow-origin"/>
|
|
<script src="/resources/testharness.js"></script>
|
|
<script src="/resources/testharnessreport.js"></script>
|
|
<script src="/common/get-host-info.sub.js"></script>
|
|
<script src="resources/entry-invariants.js"></script>
|
|
<script>
|
|
|
|
const {ORIGINAL_HOST, PORT, PORT2} = get_host_info();
|
|
|
|
// The main page is being requested on the default port (PORT), while the
|
|
// subresource will be requested on a separate port (PORT2). The response will
|
|
// have a Timing-Allow-Origin header value with the second port so this page's
|
|
// origin should not be a match.
|
|
const port_mismatch_url = `${location.protocol}//${ORIGINAL_HOST}:${PORT2}` +
|
|
`/resource-timing/resources/TAOResponse.py?` +
|
|
`tao=origin_port_${PORT2}`;
|
|
attribute_test(
|
|
fetch, port_mismatch_url, invariants.assert_tao_failure_resource,
|
|
"A port mismatch must fail the TAO check");
|
|
|
|
// The same URL as above except the Timing-Allow-Origin header will have the
|
|
// same port as this page's origin. Therefore, this page's origin will match
|
|
// the Timing-Allow-Origin header's value. Therefore, the subresource's timings
|
|
// must be exposed.
|
|
const port_match_url = `${location.protocol}//${ORIGINAL_HOST}:${PORT2}` +
|
|
`/resource-timing/resources/TAOResponse.py?` +
|
|
`tao=origin_port_${PORT}`;
|
|
attribute_test(
|
|
fetch, port_match_url, invariants.assert_tao_pass_no_redirect_http,
|
|
"An identical port must pass the TAO check");
|
|
|
|
</script>
|
|
</head>
|
|
<body>
|
|
<h1>Description</h1>
|
|
<p>This test validates that for a cross origin resource with different ports,
|
|
the timing allow check algorithm will fail when the value of
|
|
Timing-Allow-Origin value has the right host but the wrong port in it.</p>
|
|
</body>
|
|
</html>
|