mirror of
https://github.com/servo/servo.git
synced 2025-08-06 06:00:15 +01:00
75 lines
2.7 KiB
HTML
75 lines
2.7 KiB
HTML
<!DOCTYPE html>
|
|
<script src=/resources/testharness.js></script>
|
|
<script src=/resources/testharnessreport.js></script>
|
|
<script src=/common/security-features/resources/common.js></script>
|
|
<script src=/fetch/sec-metadata/resources/helper.js></script>
|
|
<body>
|
|
<script>
|
|
// These tests reuse the `referrer-policy` infrastructure to load images that
|
|
// encode their request headers in their pixels. Fun stuff!
|
|
promise_test(() =>
|
|
requestViaImage(
|
|
"https://{{host}}:{{ports[https][0]}}/common/security-features/subresource/image.py")
|
|
.then(result => {
|
|
headers = result.headers;
|
|
got = {
|
|
"dest": headers["sec-fetch-dest"],
|
|
"mode": headers["sec-fetch-mode"],
|
|
"site": headers["sec-fetch-site"],
|
|
"user": headers["sec-fetch-user"]
|
|
};
|
|
assert_header_equals(got, {
|
|
"dest": "image",
|
|
"site": "same-origin",
|
|
// Note that we're using `undefined` here, as opposed to "" elsewhere because of the way
|
|
// that `image.py` encodes data.
|
|
"user": undefined,
|
|
"mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin`
|
|
});
|
|
}),
|
|
"Same-origin image");
|
|
|
|
promise_test(() =>
|
|
requestViaImage(
|
|
"https://{{hosts[][www]}}:{{ports[https][0]}}/common/security-features/subresource/image.py")
|
|
.then(result => {
|
|
headers = result.headers;
|
|
got = {
|
|
"dest": headers["sec-fetch-dest"],
|
|
"mode": headers["sec-fetch-mode"],
|
|
"site": headers["sec-fetch-site"],
|
|
"user": headers["sec-fetch-user"]
|
|
};
|
|
assert_header_equals(got, {
|
|
"dest": "image",
|
|
"site": "same-site",
|
|
// Note that we're using `undefined` here, as opposed to "" elsewhere because of the way
|
|
// that `image.py` encodes data.
|
|
"user": undefined,
|
|
"mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin`
|
|
});
|
|
}),
|
|
"Same-site image");
|
|
|
|
promise_test(() =>
|
|
requestViaImage(
|
|
"https://{{hosts[alt][www]}}:{{ports[https][0]}}/common/security-features/subresource/image.py")
|
|
.then(result => {
|
|
headers = result.headers;
|
|
got = {
|
|
"dest": headers["sec-fetch-dest"],
|
|
"mode": headers["sec-fetch-mode"],
|
|
"site": headers["sec-fetch-site"],
|
|
"user": headers["sec-fetch-user"]
|
|
};
|
|
assert_header_equals(got, {
|
|
"dest": "image",
|
|
"site": "cross-site",
|
|
// Note that we're using `undefined` here, as opposed to "" elsewhere because of the way
|
|
// that `image.py` encodes data.
|
|
"user": undefined,
|
|
"mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin`
|
|
});
|
|
}),
|
|
"Cross-site image");
|
|
</script>
|