| CONSOLE MESSAGE: line 5: The XSS Auditor refused to execute a script in 'http://127.0.0.1:8000/security/xssAuditor/resources/nph-cached.pl?q=%3cscript%3ealert(/XSS/);%3c/script%3e' because its source code was found within the request. The server sent an 'X-XSS-Protection' header requesting this behavior. |
| CONSOLE MESSAGE: line 5: The XSS Auditor refused to execute a script in 'http://127.0.0.1:8000/security/xssAuditor/resources/nph-cached.pl?q=%3cscript%3ealert(/XSS/);%3c/script%3e' because its source code was found within the request. The server sent an 'X-XSS-Protection' header requesting this behavior. |
| Check that an X-XSS-Protection header added by a 304 response does not override one from the original request. |
| |
| On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE". |
| |
| |
| Two console messages should be generated, noting that JavaScript was blocked. |
| Check that the nonce is the same, meaning that the document was only generated once: |
| PASS frame1.contentDocument.querySelector("input").value == frame2.contentDocument.querySelector("input").value is true |
| PASS successfullyParsed is true |
| |
| TEST COMPLETE |
| |
