send-authentication-cors-setrequestheader-no-cred.htm (2909B)
1 <!doctype html> 2 <html> 3 <head> 4 <title>XMLHttpRequest: send() - "Basic" authenticated CORS request using setRequestHeader() but not setting withCredentials (expects to succeed)</title> 5 <script src="/resources/testharness.js"></script> 6 <script src="/resources/testharnessreport.js"></script> 7 <script src="/common/utils.js"></script> 8 <script src="/common/get-host-info.sub.js"></script> 9 <!-- These spec references do not make much sense simply because the spec doesn't say very much about this.. --> 10 <link rel="help" href="https://xhr.spec.whatwg.org/#the-setrequestheader()-method" data-tested-assertations="following::ol[1]/li[6]" /> 11 <link rel="help" href="https://xhr.spec.whatwg.org/#the-send()-method" data-tested-assertations="following::code[contains(@title,'http-authorization')]/.." /> 12 </head> 13 <body> 14 <div id="log"></div> 15 <script> 16 function doTest(desc, pathsuffix, conditionsFunc, errorFunc, endFunc) { 17 var test = async_test(desc) 18 test.step(function() { 19 var client = new XMLHttpRequest(), 20 urlstart = get_host_info().REMOTE_ORIGIN + location.pathname.replace(/\/[^\/]*$/, '/'), 21 user = token() 22 client.open("GET", urlstart + "resources/" + pathsuffix, false) 23 client.setRequestHeader("x-user", user) 24 client.setRequestHeader("x-pass", 'pass') 25 client.setRequestHeader("Authorization", "Basic " + btoa(user + ":pass")) 26 client.onerror = test.step_func(errorFunc) 27 client.onreadystatechange = test.step_func(function () { 28 if(client.readyState < 4) {return} 29 conditionsFunc(client, test, user) 30 }) 31 if(endFunc) { 32 client.onloadend = test.step_func(endFunc) 33 } 34 client.send(null) 35 }) 36 } 37 38 doTest("CORS request with setRequestHeader auth to URL accepting Authorization header", "auth7/corsenabled.py", function (client, test, user) { 39 assert_true(client.responseText == (user + "\npass"), "responseText should contain the right user and password") 40 assert_equals(client.status, 200) 41 assert_equals(client.getResponseHeader("x-challenge"), "DID-NOT") 42 test.done() 43 }, function(){ 44 assert_unreached("Cross-domain request is permitted and should not cause an error") 45 this.done() 46 }) 47 48 var errorFired = false; 49 doTest("CORS request with setRequestHeader auth to URL NOT accepting Authorization header", "auth8/corsenabled-no-authorize.py", function (client, test, user) { 50 assert_equals(client.responseText, '') 51 assert_equals(client.status, 0) 52 }, function(e){ 53 errorFired = true 54 assert_equals(e.type, 'error', 'Error event fires when Authorize is a user-set header but not allowed by the CORS endpoint') 55 }, function() { 56 assert_true(errorFired, 'The error event should fire') 57 this.done() 58 }) 59 60 </script> 61 </body> 62 </html>