src/third_party/WebKit/LayoutTests/http/tests/security/img-crossorigin-redirect-credentials.html

   1 <!DOCTYPE HTML>
   2 <script src="/js-test-resources/js-test.js"></script>
   3 <script>
   4 description("Testing the handling of CORS-enabled fetch in the presence of 'credentialled' redirects.");
   5
   6 // Explain the short form descriptions ('=>' representing the redirect.)
   7 debug("PASS/FAIL descriptions are of the form, 'CORS request type': 'redirect CORS type' => 'resource'");
   8 debug("");
   9
  10 var redirect_cors = "use-credentials";
  11
  12 window.jsTestIsAsync = true;
  13 if (window.testRunner)
  14     testRunner.dumpAsText();
  15
  16 function finish() {
  17     if (window.testRunner)
  18         finishJSTest();
  19 }
  20
  21 function fail() {
  22     debug("FAIL: " + this.description);
  23     runNextTest();
  24 }
  25
  26 function pass() {
  27     debug("PASS: " + this.description);
  28     runNextTest();
  29 }
  30
  31 var tests = [
  32     { description: "Anonymous request: credentialled => no-CORS image resource.",
  33       url: "http://localhost:8000/security/resources/abe.png",
  34       // Redirect is allowed, but fails access check on the non-CORS resource.
  35       success: false,
  36       access: "anonymous"},
  37     { description: "Anonymous request: credentialled => anonymous CORS image resource (same origin.)",
  38       url: "http://localhost:8000/security/resources/abe-allow-star.php",
  39       // Redirect is allowed, as is access to the anonymous CORS resource.
  40       success: true,
  41       access: "anonymous"},
  42     { description: "Anonymous request: credentialled => anonymous CORS image resource (cross origin.)",
  43       url: "http://localhost:8080/security/resources/abe-allow-star.php",
  44       // Redirect is allowed, as is access (with origin 'null') to the CORS resource.
  45       success: true,
  46       access: "anonymous"},
  47     { description: "Credentialled request: credentialled => credentialled-CORS image resource (same origin.)",
  48       url: "http://localhost:8000/security/resources/abe-allow-credentials.php",
  49       // Redirect is allowed, as is access (with original origin) to the CORS resource.
  50       success: true,
  51       access: "use-credentials"},
  52     { description: "Credentialled request: credentialled => credentialled-CORS image resource (cross origin.)",
  53       url: "http://127.0.0.1:8080/security/resources/abe-allow-credentials.php",
  54       // Redirect is allowed, source origin mutates to 'null', so credentialled resource not accessible.
  55       success: false,
  56       access: "use-credentials"},
  57     { description: "Credentialled request: credentialled => anonymous-CORS image resource (same origin.)",
  58       url: "http://localhost:8000/security/resources/abe-allow-star.php",
  59       // Redirect is allowed, but anonymous resource with * as allowed origins is not accessible.
  60       success: false,
  61       access: "use-credentials"},
  62     { description: "Credentialled request: credentialled => anonymous-CORS image resource (cross origin.)",
  63       url: "http://127.0.0.1:8000/security/resources/abe-allow-star.php",
  64       // Redirect is allowed, source origin mutates to 'null', so anonymous resource with * as allowed origins is not accessible.
  65       success: false,
  66       access: "use-credentials"},
  67     ];
  68
  69 function runNextTest() {
  70     if (!tests.length) {
  71         finish();
  72         return;
  73     }
  74     var test = tests.shift();
  75     var img = new Image();
  76     img.onload = test.success ? pass : fail;
  77     img.onerror = test.success ? fail : pass;
  78     img.crossOrigin = test.access;
  79     img.description = test.description;
  80     var args = [ "mode=" + redirect_cors,
  81                  "url=" + test.url];
  82     img.src = "http://localhost:8000/security/resources/cors-redirect.php?" + args.join("&");
  83     document.body.appendChild(img);
  84 }
  85 window.onload = runNextTest;
  86 </script>