CSP Suborigins

LayoutTests/http/tests/security/contentSecurityPolicy/suborigin-allow-in-http-header.html

Index: LayoutTests/http/tests/security/contentSecurityPolicy/suborigin-allow-in-http-header.html
diff --git a/LayoutTests/http/tests/security/contentSecurityPolicy/suborigin-allow-in-http-header.html b/LayoutTests/http/tests/security/contentSecurityPolicy/suborigin-allow-in-http-header.html
new file mode 100644
index 0000000000000000000000000000000000000000..9c3272e45aa7fa1af0af59faba7b9e0d520f0221
--- /dev/null
+++ b/LayoutTests/http/tests/security/contentSecurityPolicy/suborigin-allow-in-http-header.html
@@ -0,0 +1,22 @@
+<meta http-equiv="Content-Security-Policy" content="suborigin foobar">
+<script>
+if (window.testRunner) {
+    testRunner.waitUntilDone();
+    testRunner.dumpAsText();
+}
+
+function iframeLoaded() {
+    var iframe = document.getElementById('iframe');
+    try {
+        var secret = iframe.contentWindow.secret;
+        alert("PASS: Secret is '" + secret + "'.");
+    } catch(e) {
+        alert('FAIL: Prevented from accessing the content of the iframe in the same suborigin.');
+    }
+    testRunner.notifyDone();
+}
+</script>
+<p>
+This tests whether a frame in a can access secrets in a frame in the same suborigin.
+</p>
+<iframe onload="iframeLoaded();" id="iframe" src="resources/suborigin.php?suborigin=foobar"></iframe>