TAOResponse.py (2665B)
1 import os 2 3 def main(request, response): 4 if b'origin' in request.headers: 5 origin = request.headers[b'origin'] 6 response.headers.set(b'Access-Control-Allow-Origin', origin) 7 8 tao = request.GET.first(b'tao') 9 img = request.GET.first(b'img') if b'img' in request.GET else None 10 11 if tao == b'zero': 12 # zero TAO value, fail 13 pass 14 elif tao == b'wildcard': 15 # wildcard, pass 16 response.headers.set(b'Timing-Allow-Origin', b'*') 17 elif tao == b'null': 18 # null, fail unless it's an opaque origin 19 response.headers.set(b'Timing-Allow-Origin', b'null') 20 elif tao == b'Null': 21 # case-insensitive null, fail 22 response.headers.set(b'Timing-Allow-Origin', b'Null') 23 elif tao == b'origin': 24 # case-sensitive match for origin, pass 25 response.headers.set(b'Timing-Allow-Origin', origin) 26 elif tao.startswith(b'origin_port'): 27 # case-sensitive match for origin and port, pass 28 origin_parts = origin.split(b':') 29 host = origin_parts[0] + b':' + origin_parts[1] 30 port = tao.split(b'origin_port_')[1] 31 response.headers.set(b'Timing-Allow-Origin', host + b':' + port) 32 elif tao == b'space': 33 # space separated list of origin and wildcard, fail 34 response.headers.set(b'Timing-Allow-Origin', (origin + b' *')) 35 elif tao == b'multi': 36 # more than one TAO values, separated by comma, pass 37 response.headers.set(b'Timing-Allow-Origin', origin) 38 response.headers.append(b'Timing-Allow-Origin', b'*') 39 elif tao == b'multi_wildcard': 40 # multiple wildcards, separated by comma, pass 41 response.headers.set(b'Timing-Allow-Origin', b'*') 42 response.headers.append(b'Timing-Allow-Origin', b'*') 43 elif tao == b'match_origin': 44 # contains a match of origin, separated by comma, pass 45 response.headers.set(b'Timing-Allow-Origin', origin) 46 response.headers.append(b'Timing-Allow-Origin', b"fake") 47 elif tao == b'match_wildcard': 48 # contains a wildcard, separated by comma, pass 49 response.headers.set(b'Timing-Allow-Origin', b"fake") 50 response.headers.append(b'Timing-Allow-Origin', b'*') 51 elif tao == b'uppercase': 52 # non-case-sensitive match for origin, fail 53 response.headers.set(b'Timing-Allow-Origin', origin.upper()) 54 else: 55 pass 56 response.status = 200 57 if img: 58 response.headers.set(b"Content-Type", b"image/png") 59 with open(request.doc_root + "/resource-timing/resources/blue.png", "rb") as f: 60 response.content = f.read() 61 f.close() 62 else: 63 response.headers.set(b"Content-Type", b"text/plain") 64 response.content = "TEST"