| <!DOCTYPE html> |
| <html> |
| <head> |
| <script> |
| if (window.testRunner) { |
| testRunner.dumpAsText(); |
| testRunner.waitUntilDone(); |
| } |
| </script> |
| </head> |
| <body> |
| <p>This tests an XHR request made from a worker is blocked if it redirects to a cross-origin resource that is not listed as a connect-src in the CSP of the worker.</p> |
| <pre id="result"></pre> |
| <script> |
| window.onmessage = function (event) |
| { |
| document.getElementById("result").textContent = event.data; |
| if (window.testRunner) |
| testRunner.notifyDone(); |
| } |
| |
| var worker; |
| try { |
| worker = new Worker("http://127.0.0.1:8000/security/contentSecurityPolicy/resources/worker-xhr-redirect-cross-origin-blocked.php?csp=" + encodeURIComponent("connect-src http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.php")); |
| worker.onmessage = function (event) { window.postMessage(event.data, "*") }; |
| } catch (exception) { |
| window.postMessage("FAIL should not have thrown an exception when creating worker. Threw exception " + exception + ".", "*"); |
| } |
| </script> |
| </body> |
| </html> |
