<!DOCTYPE html>
<script src=/resources/testharness.js></script>
<script src=/resources/testharnessreport.js></script>
<script src=/common/security-features/resources/common.sub.js></script>
<script src=/fetch/metadata/resources/helper.js></script>
<body>
<script>
  // These tests reuse the `referrer-policy` infrastructure to load images that
  // encode their request headers in their pixels. Fun stuff!
  promise_test(() =>
    requestViaImage(
      "https://{{host}}:{{ports[https][0]}}/common/security-features/subresource/image.py")
    .then(result => {
        headers = result.headers;
        got = {
          "mode": headers["sec-fetch-mode"],
          "site": headers["sec-fetch-site"],
          "user": headers["sec-fetch-user"],
          "dest": headers["sec-fetch-dest"]
        };
        assert_header_equals(got, {
          "site": "same-origin",
          // Note that we're using `undefined` here, as opposed to "" elsewhere because of the way
          // that `image.py` encodes data.
          "user": undefined,
          "mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin`
          "dest": "image"
        }, "Same-origin image");
      }),
    "Same-origin image");

  promise_test(() =>
    requestViaImage(
      "https://{{hosts[][www]}}:{{ports[https][0]}}/common/security-features/subresource/image.py")
    .then(result => {
        headers = result.headers;
        got = {
          "mode": headers["sec-fetch-mode"],
          "site": headers["sec-fetch-site"],
          "user": headers["sec-fetch-user"],
          "dest": headers["sec-fetch-dest"]
        };
        assert_header_equals(got, {
          "site": "same-site",
          // Note that we're using `undefined` here, as opposed to "" elsewhere because of the way
          // that `image.py` encodes data.
          "user": undefined,
          "mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin`
          "dest": "image"
        }, "Same-site image");
      }),
    "Same-site image");

  promise_test(() =>
    requestViaImage(
      "https://{{hosts[alt][www]}}:{{ports[https][0]}}/common/security-features/subresource/image.py")
    .then(result => {
        headers = result.headers;
        got = {
          "mode": headers["sec-fetch-mode"],
          "site": headers["sec-fetch-site"],
          "user": headers["sec-fetch-user"],
          "dest": headers["sec-fetch-dest"]
        };
        assert_header_equals(got, {
          "site": "cross-site",
          // Note that we're using `undefined` here, as opposed to "" elsewhere because of the way
          // that `image.py` encodes data.
          "user": undefined,
          "mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin`
          "dest": "image"
        }, "Cross-site image");
      }),
    "Cross-site image");
</script>