<html>
<body>
<p>Test that setRequestHeader cannot be used to alter security-sensitive headers.</p>
<pre id=result>FAIL: script didn't run or raised an unexpected exception.</pre>
<script>
    if (window.layoutTestController)
        layoutTestController.dumpAsText();
    
    req = new XMLHttpRequest;
    req.open("GET", "resources/print-headers.cgi", false);

    req.setRequestHeader("ACCEPT-CHARSET", "foobar");
    req.setRequestHeader("ACCEPT-ENCODING", "foobar");
    req.setRequestHeader("CONTENT-LENGTH", "123456");
    req.setRequestHeader("EXPECT", "100-continue");
    req.setRequestHeader("DATE", "foobar");
    req.setRequestHeader("HOST", "foobar");
    req.setRequestHeader("KEEP-ALIVE", "foobar");
    req.setRequestHeader("REFERER", "foobar");
    req.setRequestHeader("TE", "foobar");
    req.setRequestHeader("TRAILER", "foobar");
    req.setRequestHeader("TRANSFER-ENCODING", "foobar");
    req.setRequestHeader("UPGRADE", "foobar");
    req.setRequestHeader("VIA", "foobar");

    try {
        req.send("");
        if (req.responseText.match("100-continue|foobar|123456"))
            document.getElementById("result").textContent = req.responseText;
        else
            document.getElementById("result").textContent = "SUCCESS";
    } catch (ex) {
        document.getElementById("result").textContent = ex;
    }
</script>
</body>
</html>