| <head> |
| <script src="/js-test-resources/js-test.js"></script> |
| <script> |
| function doTest() { |
| description(`If the request contains credentials in its url, they should be stripped from it. |
| Also first attempt shouldn't contain basic auth header.`); |
| window.jsTestIsAsync = true; |
| |
| window.xhr = new XMLHttpRequest(); |
| const baseUrl = 'http://foo:bar@127.0.0.1:8000/xmlhttprequest/resources/url-with-credentials/'; |
| |
| /* 1.a [Sync] First trial must be access without credentials. */ |
| xhr.open('GET', baseUrl + 'authenticate.py', false); |
| xhr.send(null); |
| shouldBe(() => xhr.responseText, "'User: Password: '"); |
| |
| /* 1.b [Sync] Send auth info after getting authorization header. */ |
| xhr.open('GET', baseUrl + 'authorize.py', false); |
| xhr.send(null); |
| shouldBe(() => xhr.responseText, "'User: foo Password: bar'"); |
| |
| /* 2.a [Async] First trial must be access without credentials. */ |
| xhr.open('GET', baseUrl + 'authenticate.py', true); |
| xhr.onerror = xhr.onload = () => { |
| shouldBe(() => xhr.responseText, "'User: Password: '"); |
| |
| /* 2.b [Async] Send auth info after getting authorization header. */ |
| xhr.open('GET', baseUrl + 'authorize.py', true); |
| xhr.onerror = xhr.onload = () => { |
| shouldBe(() => xhr.responseText, "'User: foo Password: bar'"); |
| |
| finishJSTest(); |
| }; |
| xhr.send(null); |
| }; |
| xhr.send(null); |
| } |
| </script> |
| </head> |
| |
| <body onload="doTest()"> |
| <div id="description"></div> |
| <div id="console"></div> |
| </body> |
| |
| </html> |
