OLD | NEW |
1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
2 <html> | 2 <html> |
3 <head> | 3 <head> |
4 <script src="/resources/testharness.js"></script> | 4 <script src="/resources/testharness.js"></script> |
5 <script src="/resources/testharnessreport.js"></script> | 5 <script src="/resources/testharnessreport.js"></script> |
6 </head> | 6 </head> |
7 <body> | 7 <body> |
8 <script> | 8 <script> |
9 async_test(function (t) { | 9 async_test(function (t) { |
10 var i = document.createElement('iframe'); | 10 var i = document.createElement('iframe'); |
11 i.src = "../../resources/frame-ancestors-and-x-frame-options.pl?poli
cy='self'&xfo=DENY"; | 11 i.src = "support/frame-ancestors-and-x-frame-options.sub.html?policy
='self'&xfo=DENY"; |
12 i.onload = t.step_func_done(function () { | 12 i.onload = t.step_func_done(function () { |
13 assert_equals(i.contentDocument.origin, document.origin, "The sa
me-origin page loaded."); | 13 assert_equals(i.contentDocument.origin, document.origin, "The sa
me-origin page loaded."); |
14 }); | 14 }); |
15 document.body.appendChild(i); | 15 document.body.appendChild(i); |
16 }, "A 'frame-ancestors' CSP directive overrides an 'x-frame-options' hea
der which would block the page."); | 16 }, "A 'frame-ancestors' CSP directive overrides an 'x-frame-options' hea
der which would block the page."); |
17 | 17 |
18 async_test(function (t) { | 18 async_test(function (t) { |
19 var i = document.createElement('iframe'); | 19 var i = document.createElement('iframe'); |
20 i.src = "../../resources/frame-ancestors-and-x-frame-options.pl?poli
cy=other-origin.com&xfo=SAMEORIGIN"; | 20 i.src = "support/frame-ancestors-and-x-frame-options.sub.html?policy
=other-origin.com&xfo=SAMEORIGIN"; |
21 i.onload = t.step_func_done(function () { | 21 i.onload = t.step_func_done(function () { |
22 assert_throws( | 22 assert_throws( |
23 "SecurityError", | 23 "SecurityError", |
24 function () { i.contentDocument.origin }, | 24 function () { i.contentDocument.origin }, |
25 "The same-origin page was blocked and sandboxed."); | 25 "The same-origin page was blocked and sandboxed."); |
26 }); | 26 }); |
27 document.body.appendChild(i); | 27 document.body.appendChild(i); |
28 }, "A 'frame-ancestors' CSP directive overrides an 'x-frame-options' hea
der which would allow the page."); | 28 }, "A 'frame-ancestors' CSP directive overrides an 'x-frame-options' hea
der which would allow the page."); |
29 </script> | 29 </script> |
30 </body> | 30 </body> |
31 </html> | 31 </html> |
OLD | NEW |