<!DOCTYPE html><!-- webkit-test-runner [ allowCrossOriginSubresourcesToAskForCredentials=true ] -->
<html>
<head>
<script src="/js-test-resources/js-test.js"></script>
<script>
if (window.testRunner) {
    testRunner.setHandlesAuthenticationChallenges(true);
    testRunner.setAuthenticationUsername("testUser");
    testRunner.setAuthenticationPassword("testPassword");
}

window.jsTestIsAsync = true;

function pass()
{
    testPassed("did load image.");
    finishJSTest();
}

function fail()
{
    testFailed("did not load image.");
    finishJSTest();
}

function runTest()
{
    // Load the image programmatically instead of declaratively to avoid output flakiness caused by
    // the preload scanner performing mixed content checks as part of preloading the image.
    let image = new Image;
    image.onload = pass;
    image.onerror = fail;
    image.src = "http://localhost:8000/security/mixedContent/resources/subresource2/protected-image.php";
    document.body.appendChild(image);
}

window.onload = runTest;
</script>
</head>
<body>
<script>
description("Tests that we do not ask for credentials when loading an insecure image that requires basic authentication.");
</script>
</body>
</html>