LayoutTests/http/tests/security/script-crossorigin-redirect-credentials.html - Issue 149643003: Improve handling of CORS redirects for some resource loads.

Side by Side Diff: LayoutTests/http/tests/security/script-crossorigin-redirect-credentials.html

Issue 149643003: Improve handling of CORS redirects for some resource loads. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master

Patch Set: Use canRequest() when checking redirect origin; remove redundant null checks. Created 6 years, 10 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

« no previous file with comments | « LayoutTests/http/tests/security/script-crossorigin-redirect-anonymous-expected.txt ('k') | LayoutTests/http/tests/security/script-crossorigin-redirect-credentials-expected.txt » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
(Empty)
	1 <!DOCTYPE HTML>

	2 <script src="/js-test-resources/js-test.js"></script>

	3 <script>

	4 description("Testing the handling of CORS-enabled script fetch in the presence o f 'credentialled' redirects.");

	5

	6 // Explain the short form descriptions ('=>' representing the redirect.)

	7 debug("PASS/FAIL descriptions are of the form, 'CORS request type': 'redirect CO RS type' => 'resource'");

	8 debug("");

	9

	10 var redirect_cors = "use-credentials";

	11

	12 window.jsTestIsAsync = true;

	13 if (window.testRunner)

	14 testRunner.dumpAsText();

	15

	16 function finish() {

	17 if (window.testRunner)

	18 finishJSTest();

	19 }

	20

	21 function fail() {

	22 debug("FAIL: " + this.description);

	23 runNextTest();

	24 }

	25

	26 function pass() {

	27 debug("PASS: " + this.description);

	28 runNextTest();

	29 }

	30

	31 var tests = [

	32 { description: "Anonymous request: credentialled => no-CORS script resource. ",

	33 url: "http://localhost:8000/security/resources/localScript.js",

	34 // Redirect is allowed, but fails access check on the non-CORS resource.

	35 success: false,

	36 access: "anonymous"},

	37 { description: "Anonymous request: credentialled => anonymous CORS script re source (same origin.)",

	38 url: "http://localhost:8000/security/resources/script-allow-star.php",

	39 // Redirect is allowed, as is access to the anonymous CORS resource.

	40 success: true,

	41 access: "anonymous"},

	42 { description: "Anonymous request: credentialled => anonymous CORS script re source (cross origin.)",

	43 url: "http://localhost:8080/security/resources/script-allow-star.php",

	44 // Redirect is allowed, as is access (with origin 'null') to the CORS reso urce.

	45 success: true,

	46 access: "anonymous"},

	47 { description: "Credentialled request: credentialled => credentialled-CORS s cript resource (same origin.)",

	48 url: "http://localhost:8000/security/resources/script-allow-credentials.ph p",

	49 // Redirect is allowed, as is access (with original origin) to the CORS re source.

	50 success: true,

	51 access: "use-credentials"},

	52 { description: "Credentialled request: credentialled => credentialled-CORS s cript resource (cross origin.)",

	53 url: "http://127.0.0.1:8000/security/resources/script-allow-credentials.ph p",

	54 // Redirect is allowed, source origin mutates to 'null', so credentialled resource not accessible.

	55 success: false,

	56 access: "use-credentials"},

	57 { description: "Credentialled request: credentialled => anonymous-CORS scrip t resource (same origin.)",

	58 url: "http://localhost:8000/security/resources/script-allow-star.php",

	59 // Redirect is allowed, but anonymous resource with * as allowed origins i s not accessible.

	60 success: false,

	61 access: "use-credentials"},

	62 { description: "Credentialled request: credentialled => anonymous-CORS scrip t resource (cross origin.)",

	63 url: "http://127.0.0.1:8000/security/resources/script-allow-star.php",

	64 // Redirect is allowed, source origin mutates to 'null', so anonymous reso urce with * as allowed origins is not accessible.

	65 success: false,

	66 access: "use-credentials"},

	67 ];

	68

	69 function runNextTest() {

	70 if (!tests.length) {

	71 finish();

	72 return;

	73 }

	74 var test = tests.shift();

	75 var script = document.createElement("script");

	76 script.onload = test.success ? pass : fail;

	77 script.onerror = test.success ? fail : pass;

	78 script.crossOrigin = test.access;

	79 script.description = test.description;

	80 var args = [ "mode=" + redirect_cors,

	81 "url=" + test.url];

	82 script.src = "http://localhost:8000/security/resources/cors-redirect.php?" + args.join("&");

	83 document.body.appendChild(script);

	84 }

	85 window.onload = runNextTest;

	86 </script>

OLD	NEW