| <!DOCTYPE html> |
| <html> |
| <head> |
| <meta http-equiv="Content-Security-Policy" content="connect-src 'none'"/> |
| <script src="/js-test-resources/testharness.js"></script> |
| <script src="/js-test-resources/testharnessreport.js"></script> |
| </head> |
| <body> |
| <script> |
| // If the worker does not get served with a CSP header, than it should |
| // have no CSP, not the CSP of the responsible document. |
| |
| async_test(function () { |
| var worker = new Worker('http://127.0.0.1:8000/security/contentSecurityPolicy/resources/worker.py?type=make-xhr'); |
| worker.onmessage = this.step_func(function (event) { |
| assert_equals(event.data, "xhr allowed"); |
| this.done(); |
| }); |
| }, "Worker should not inherit document's CSP"); |
| </script> |
| </body> |
| </html> |
