TAO-port-mismatch-means-crossorigin.html (2007B)
1 <!DOCTYPE html> 2 <html> 3 <head> 4 <meta charset="utf-8" /> 5 <title>TAO - port mismatch must fail the check</title> 6 <link rel="author" title="Google" href="http://www.google.com/" /> 7 <link rel="help" href="https://www.w3.org/TR/resource-timing-2/#sec-timing-allow-origin"/> 8 <script src="/resources/testharness.js"></script> 9 <script src="/resources/testharnessreport.js"></script> 10 <script src="/common/get-host-info.sub.js"></script> 11 <script src="resources/entry-invariants.js"></script> 12 <script> 13 14 const {ORIGINAL_HOST, PORT, PORT2} = get_host_info(); 15 16 // The main page is being requested on the default port (PORT), while the 17 // subresource will be requested on a separate port (PORT2). The response will 18 // have a Timing-Allow-Origin header value with the second port so this page's 19 // origin should not be a match. 20 const port_mismatch_url = `${location.protocol}//${ORIGINAL_HOST}:${PORT2}` + 21 `/resource-timing/resources/TAOResponse.py?` + 22 `tao=origin_port_${PORT2}`; 23 attribute_test( 24 fetch, port_mismatch_url, invariants.assert_tao_failure_resource, 25 "A port mismatch must fail the TAO check"); 26 27 // The same URL as above except the Timing-Allow-Origin header will have the 28 // same port as this page's origin. Therefore, this page's origin will match 29 // the Timing-Allow-Origin header's value. Therefore, the subresource's timings 30 // must be exposed. 31 const port_match_url = `${location.protocol}//${ORIGINAL_HOST}:${PORT2}` + 32 `/resource-timing/resources/TAOResponse.py?` + 33 `tao=origin_port_${PORT}`; 34 attribute_test( 35 fetch, port_match_url, invariants.assert_tao_pass_no_redirect_http, 36 "An identical port must pass the TAO check"); 37 38 </script> 39 </head> 40 <body> 41 <h1>Description</h1> 42 <p>This test validates that for a cross origin resource with different ports, 43 the timing allow check algorithm will fail when the value of 44 Timing-Allow-Origin value has the right host but the wrong port in it.</p> 45 </body> 46 </html>