Adding Embedding-CSP HTTP header

third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/resources/get-embedding-csp-header-and-respond.php

Index: third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/resources/get-embedding-csp-header-and-respond.php
diff --git a/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/resources/get-embedding-csp-header-and-respond.php b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/resources/get-embedding-csp-header-and-respond.php
new file mode 100644
index 0000000000000000000000000000000000000000..38dcc9f2d26cbdc8f34a9e1f7da0f5c28e80d48f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/resources/get-embedding-csp-header-and-respond.php
@@ -0,0 +1,10 @@
+<?php
+    $embedding_csp_header = isset($_SERVER['HTTP_EMBEDDING_CSP']) ? $_SERVER['HTTP_EMBEDDING_CSP'] : 'null';
+?>
+
+<script>
+  var response = {};
+  response['src'] = '../resources/get-embedding-csp-header-and-respond.php';
+  response['embedding_csp'] = "<?php echo $embedding_csp_header; ?>";

[Mike West, 2016/10/06 08:00:50]

Nit: It's confusing to use a string "null" here when JavaScript has a `null`
value that's probably more like what you want. Perhaps you could change this to
output a string when there's a header, and the bareword `null` when there's not.
Then you'd `assert_equals(null, ...)` in the tests to verify that no header was
sent (as opposed to a header whose value was the string "null").

[amalika, 2016/10/06 13:06:02]

I just didnt know how to convert php NULL value to be 'null' in javascript
without ugly php if statements inside <script> since the value is echoed inside
a string. I changed it to NULL in php but now response['embedding_csp'] is an
empty string.

+  window.top.postMessage(response, '*');
+</script>