| <!DOCTYPE html> |
| <html> |
| <head> |
| <title>XMLHttpRequest: ensure user script headers do not get dropped during cross-origin redirections</title> |
| <script src="/resources/testharness.js"></script> |
| <script src="/resources/testharnessreport.js"></script> |
| </head> |
| <body> |
| <script type="text/javascript"> |
| function doTest(testName, testURL, simpleRequest, crossOriginRedirect) |
| { |
| promise_test(function(test) { |
| var resolvePromise, rejectPromise; |
| var promise = new Promise((resolve, reject) => { |
| resolvePromise = resolve; |
| rejectPromise = reject; |
| }); |
| |
| var xhr = new XMLHttpRequest; |
| xhr.open("GET", testURL); |
| xhr.setRequestHeader("accept", "groovy"); |
| |
| if (!simpleRequest) { |
| xhr.setRequestHeader("x-webkit", "funky"); |
| xhr.setRequestHeader("content-type", "rocky"); |
| xhr.setRequestHeader("authorization", "Basic QXV0aG9yaXphdGlvbi1IZWFkZXI6QXV0aG9yaXphdGlvbi1IZWFkZXI="); |
| } |
| |
| xhr.onload = (test) => { |
| assert_true(xhr.responseText.indexOf("accept header found: groovy") !== -1, "xhr final request should have an accept=groovy header"); |
| if (!simpleRequest) { |
| assert_true(xhr.responseText.indexOf("x-webkit header found: funky") !== -1, "xhr final request should have a x-webkit=funky header"); |
| assert_true(xhr.responseText.indexOf("content-type header found: rocky") !== -1, "xhr final request should have a content-type=groovy header"); |
| if (crossOriginRedirect) |
| assert_true(xhr.responseText.indexOf("not found any authorization header") !== -1, "xhr final request should not have an authorization header"); |
| else |
| assert_true(xhr.responseText.indexOf("authorization header found") !== -1, "xhr final request should have an authorization header"); |
| } |
| testPassed = true; |
| } |
| |
| xhr.onerror = (e) => { |
| rejectPromise("Loading failure"); |
| } |
| |
| var testPassed = false; |
| xhr.onloadend = () => { |
| testPassed ? resolvePromise() : rejectPromise("testPassed is not true"); |
| } |
| xhr.send(); |
| return promise; |
| }, testName); |
| } |
| |
| var simpleRequest = true; |
| var crossOriginRedirect = true; |
| |
| doTest("Check headers after same-origin redirection to same-origin resource (simple request)", |
| "resources/access-control-preflight-redirect.py?redirect=true&url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-preflight-redirect.py", |
| simpleRequest, !crossOriginRedirect); |
| |
| doTest("Check headers after same-origin redirection to same-origin resource (not simple request)", |
| "resources/access-control-preflight-redirect.py?redirect=true&url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-preflight-redirect.py", |
| !simpleRequest, !crossOriginRedirect); |
| |
| doTest("Check headers after same origin redirection to cross-origin resource (simple request)", |
| "resources/access-control-preflight-redirect.py?redirect=true&url=http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py", |
| simpleRequest, crossOriginRedirect); |
| |
| doTest("Check headers after same origin redirection to cross-origin resource (not simple request)", |
| "resources/access-control-preflight-redirect.py?redirect=true&url=http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py", |
| !simpleRequest, crossOriginRedirect); |
| |
| doTest("Check headers after cross-origin redirection to same-origin resource (simple request)", |
| "http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py?redirect=true&url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-preflight-redirect.py", |
| simpleRequest, crossOriginRedirect); |
| |
| doTest("Check headers after cross-origin redirection to same-origin resource (not simple request)", |
| "http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py?redirect=true&url=http://127.0.0.1:8000/xmlhttprequest/resources/access-control-preflight-redirect.py", |
| !simpleRequest, crossOriginRedirect); |
| |
| doTest("Check headers after cross-origin redirection to cross-origin resource (simple request)", |
| "http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py?redirect=true&url=http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py", |
| simpleRequest, !crossOriginRedirect); |
| |
| doTest("Check headers after cross-origin redirection to cross-origin resource (not simple request)", |
| "http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py?redirect=true&url=http://localhost:8080/xmlhttprequest/resources/access-control-preflight-redirect.py", |
| !simpleRequest, !crossOriginRedirect); |
| |
| </script> |
| </body> |
| </html> |
| |
