Commit a63a88f2 authored by Austin James Ahlstrom's avatar Austin James Ahlstrom Committed by Commit Bot

Porting access-control-preflight-async-not-supported to WPT

Bug: 745385
Change-Id: Id0dff9b0610770a8bd781ae4274cbae96f3a67cc
Reviewed-on: https://chromium-review.googlesource.com/640450Reviewed-by: default avatarTakeshi Yoshino <tyoshino@chromium.org>
Reviewed-by: default avatarYutaka Hirano <yhirano@chromium.org>
Commit-Queue: Austin James Ahlstrom <aahlstrom@google.com>
Cr-Commit-Position: refs/heads/master@{#501551}
parent 4a98533e
<!DOCTYPE html>
<html>
<head>
<title>Async PUT request denied at preflight</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/common/get-host-info.sub.js"></script>
<script src="/common/utils.js"></script>
</head>
<body>
<script type="text/javascript">
const uuid = token();
const url = get_host_info().HTTP_REMOTE_ORIGIN +
"/XMLHttpRequest/resources/access-control-preflight-denied.py?token=" + uuid;
async_test((test) => {
let xhr = new XMLHttpRequest;
xhr.open("GET", url + "&command=reset", false);
xhr.send();
xhr = new XMLHttpRequest;
xhr.open("PUT", url, true);
xhr.onload = test.unreached_func("Cross-domain access allowed unexpectedly.");
xhr.onerror = test.step_func_done(() => {
xhr = new XMLHttpRequest;
xhr.open("GET", url + "&command=complete", false);
xhr.send();
assert_equals(xhr.responseText, "Request successfully blocked.");
});
xhr.send();
});
</script>
</body>
</html>
CONSOLE WARNING: line 19: Synchronous XMLHttpRequest on the main thread is deprecated because of its detrimental effects to the end user's experience. For more help, check https://xhr.spec.whatwg.org/.
CONSOLE ERROR: Failed to load http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://127.0.0.1:8000' is therefore not allowed access.
PASS: Request successfully blocked.
<html>
<body>
<pre id='console'></pre>
<script type="text/javascript">
function log(message)
{
document.getElementById('console').appendChild(document.createTextNode(message + "\n"));
}
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.waitUntilDone();
}
(function() {
var xhr = new XMLHttpRequest();
try {
xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=reset", false);
xhr.send(null);
} catch(e) {
log("FAIL: Unable to reset server state: [" + e.message + "].");
return;
}
xhr = new XMLHttpRequest();
try {
xhr.open("PUT", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php", true);
} catch(e) {
log("FAIL: Exception thrown. Cross-domain access is not allowed in first 'open'. [" + e.message + "].");
return;
}
xhr.onerror = function() {
xhr = new XMLHttpRequest();
try {
xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=complete", false);
try {
xhr.send(null);
} catch(e) {
log("FAIL: Exception thrown. Cross-domain access is not allowed in second 'send'. [" + e.message + "].");
}
} catch(e) {
log("FAIL: Exception thrown. Cross-domain access is not allowed in second 'open'. [" + e.message + "].");
}
log(xhr.responseText);
if (window.testRunner)
testRunner.notifyDone();
}
xhr.onreadystatechange = function() {
if (xhr.readyState == 4 && xhr.status == 200)
log("FAIL: Cross-domain access allowed in first send without throwing an exception");
}
xhr.send("");
})();
</script>
</body>
</html>
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment