| <!DOCTYPE html> |
| <html> |
| <head> |
| <meta charset="utf-8" /> |
| <title>TAO - port mismatch must fail the check</title> |
| <link rel="author" title="Google" href="http://www.google.com/" /> |
| <link rel="help" href="https://www.w3.org/TR/resource-timing-2/#sec-timing-allow-origin"/> |
| <script src="/resources/testharness.js"></script> |
| <script src="/resources/testharnessreport.js"></script> |
| <script src="/common/get-host-info.sub.js"></script> |
| <script src="resources/entry-invariants.js"></script> |
| <script> |
| |
| const {ORIGINAL_HOST, PORT, PORT2} = get_host_info(); |
| |
| // The main page is being requested on the default port (PORT), while the |
| // subresource will be requested on a separate port (PORT2). The response will |
| // have a Timing-Allow-Origin header value with the second port so this page's |
| // origin should not be a match. |
| const port_mismatch_url = `${location.protocol}//${ORIGINAL_HOST}:${PORT2}` + |
| `/resource-timing/resources/TAOResponse.py?` + |
| `tao=origin_port_${PORT2}`; |
| attribute_test( |
| fetch, port_mismatch_url, invariants.assert_tao_failure_resource, |
| "A port mismatch must fail the TAO check"); |
| |
| // The same URL as above except the Timing-Allow-Origin header will have the |
| // same port as this page's origin. Therefore, this page's origin will match |
| // the Timing-Allow-Origin header's value. Therefore, the subresource's timings |
| // must be exposed. |
| const port_match_url = `${location.protocol}//${ORIGINAL_HOST}:${PORT2}` + |
| `/resource-timing/resources/TAOResponse.py?` + |
| `tao=origin_port_${PORT}`; |
| attribute_test( |
| fetch, port_match_url, invariants.assert_tao_pass_no_redirect_http, |
| "An identical port must pass the TAO check"); |
| |
| </script> |
| </head> |
| <body> |
| <h1>Description</h1> |
| <p>This test validates that for a cross origin resource with different ports, |
| the timing allow check algorithm will fail when the value of |
| Timing-Allow-Origin value has the right host but the wrong port in it.</p> |
| </body> |
| </html> |