LayoutTests/http/tests/xmlhttprequest/set-dangerous-headers.html - Issue 378183003: Update XMLHttpRequest forbidden header names.

Side by Side Diff: LayoutTests/http/tests/xmlhttprequest/set-dangerous-headers.html

Issue 378183003: Update XMLHttpRequest forbidden header names. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master

Patch Set: Created 6 years, 5 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

« no previous file with comments | « LayoutTests/fast/xmlhttprequest/set-dangerous-headers-local-expected.txt ('k') | LayoutTests/http/tests/xmlhttprequest/set-dangerous-headers-expected.txt » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
1 <html>	1 <html>

2 <body>	2 <body>

3 <p>Test that setRequestHeader cannot be used to alter security-sensitive headers .</p>	3 <p>Test that setRequestHeader cannot be used to alter security-sensitive headers .</p>

4 <pre id=result>FAIL: script didn't run or raised an unexpected exception.</pre>	4 <pre id=result>FAIL: script didn't run or raised an unexpected exception.</pre>

5 <script>	5 <script>

6 if (window.testRunner)	6 if (window.testRunner)

7 testRunner.dumpAsText();	7 testRunner.dumpAsText();

8	8

9 req = new XMLHttpRequest;	9 req = new XMLHttpRequest;

10 req.open("GET", "resources/print-headers.cgi", false);	10 req.open("GET", "resources/print-headers.cgi", false);

11	11

12 req.setRequestHeader("ACCEPT-CHARSET", "foobar");	12 req.setRequestHeader("ACCEPT-CHARSET", "foobar");

13 req.setRequestHeader("ACCEPT-ENCODING", "foobar");	13 req.setRequestHeader("ACCEPT-ENCODING", "foobar");

14 req.setRequestHeader("ACCESS-CONTROL-REQUEST-HEADERS", "foobar");	14 req.setRequestHeader("ACCESS-CONTROL-REQUEST-HEADERS", "foobar");

15 req.setRequestHeader("ACCESS-CONTROL-REQUEST-METHOD", "foobar");	15 req.setRequestHeader("ACCESS-CONTROL-REQUEST-METHOD", "foobar");

16 // AUTHORIZATION is no longer forbidden. See	16 // AUTHORIZATION is no longer forbidden. See

17 // https://bugs.webkit.org/show_bug.cgi?id=24957 for more details. Set to	17 // https://bugs.webkit.org/show_bug.cgi?id=24957 for more details. Set to

18 // a value other than the foobar since some http servers (lighttp) do not	18 // a value other than the foobar since some http servers (lighttp) do not

19 // strip this out (Apache does).	19 // strip this out (Apache does).

20 req.setRequestHeader("AUTHORIZATION", "baz");	20 req.setRequestHeader("AUTHORIZATION", "baz");

21 req.setRequestHeader("CONNECTION", "foobar");	21 req.setRequestHeader("CONNECTION", "foobar");

22 req.setRequestHeader("CONTENT-LENGTH", "123456");	22 req.setRequestHeader("CONTENT-LENGTH", "123456");

23 req.setRequestHeader("CONTENT-TRANSFER-ENCODING", "foobar");

24 req.setRequestHeader("COOKIE", "foobar");	23 req.setRequestHeader("COOKIE", "foobar");

25 req.setRequestHeader("COOKIE2", "foobar");	24 req.setRequestHeader("COOKIE2", "foobar");

26 req.setRequestHeader("DATE", "foobar");	25 req.setRequestHeader("DATE", "foobar");

	26 req.setRequestHeader("DNT", "foobar");

27 req.setRequestHeader("EXPECT", "100-continue");	27 req.setRequestHeader("EXPECT", "100-continue");

28 req.setRequestHeader("HOST", "foobar");	28 req.setRequestHeader("HOST", "foobar");

29 req.setRequestHeader("KEEP-ALIVE", "foobar");	29 req.setRequestHeader("KEEP-ALIVE", "foobar");

30 req.setRequestHeader("ORIGIN", "foobar");	30 req.setRequestHeader("ORIGIN", "foobar");

31 req.setRequestHeader("REFERER", "foobar");	31 req.setRequestHeader("REFERER", "foobar");

32 req.setRequestHeader("TE", "foobar");	32 req.setRequestHeader("TE", "foobar");

33 req.setRequestHeader("TRAILER", "foobar");	33 req.setRequestHeader("TRAILER", "foobar");

34 req.setRequestHeader("TRANSFER-ENCODING", "foobar");	34 req.setRequestHeader("TRANSFER-ENCODING", "foobar");

35 req.setRequestHeader("UPGRADE", "foobar");	35 req.setRequestHeader("UPGRADE", "foobar");

36 req.setRequestHeader("USER-AGENT", "foobar");	36 req.setRequestHeader("USER-AGENT", "foobar");

(...skipping 12 matching lines...) Expand all Loading...
49 if (req.responseText.match("100-continue\|foobar\|123456"))	49 if (req.responseText.match("100-continue\|foobar\|123456"))

50 document.getElementById("result").textContent = req.responseText;	50 document.getElementById("result").textContent = req.responseText;

51 else	51 else

52 document.getElementById("result").textContent = "SUCCESS";	52 document.getElementById("result").textContent = "SUCCESS";

53 } catch (ex) {	53 } catch (ex) {

54 document.getElementById("result").textContent = ex;	54 document.getElementById("result").textContent = ex;

55 }	55 }

56 </script>	56 </script>

57 </body>	57 </body>

58 </html>	58 </html>

OLD	NEW