1<!DOCTYPE html>
2<html lang="en">
3<head>
4 <meta charset="UTF-8">
5 <title>Non-Standard Safelisted Headers SHOULD Trigger a Preflight</title>
6 <script src="../resources/js-test-pre.js"></script>
7</head>
8<body>
9<!-- https://fetch.spec.whatwg.org/#cors-safelisted-request-header -->
10<script>
11 if (window.testRunner) {
12 testRunner.dumpAsText();
13 testRunner.waitUntilDone();
14 }
15
16 var invocation;
17 var url = 'http://localhost:8000/xmlhttprequest/resources/cors-preflight-safelisted-headers-responder.php';
18
19 function createReadyStateHandler (description, testNumber) {
20 return function handler (e) {
21 if (invocation.readyState === XMLHttpRequest.DONE) {
22 testPassed(description);
23 if (testNumber === (testCases.length - 1)) {
24 if (window.testRunner) {
25 testRunner.notifyDone();
26 }
27 } else {
28 runTestCase(testNumber + 1);
29 }
30 }
31 }
32 }
33
34 function createOnErrorHandler (description, testNumber) {
35 return function handler (e) {
36 e.preventDefault();
37 testPassed(description);
38 if (testNumber === (testCases.length - 1)) {
39 if (window.testRunner) {
40 testRunner.notifyDone();
41 }
42 } else {
43 runTestCase(testNumber + 1);
44 }
45 }
46 }
47
48 var abnormalSimpleCorsHeaderValue = "() { :;};"
49 var testCases = [
50 // Positive test cases with normal headers
51 {
52 headersToAdd: [{ name : "Accept", value: "text/*" }],
53 explicitlyAllowHeaders: false,
54 shouldCausePreflight: false,
55 description: "Accept header with normal value SHOULD NOT cause a preflight"
56 }
57 ,{
58 headersToAdd: [{ name : "Accept-Language", value: "en" }],
59 explicitlyAllowHeaders: false,
60 shouldCausePreflight: false,
61 description: "Accept-Language header with normal value SHOULD NOT cause a preflight"
62 }
63 ,{
64 headersToAdd: [{ name : "Content-Language", value: "en" }],
65 explicitlyAllowHeaders: false,
66 shouldCausePreflight: false,
67 description: "Content-Language header with normal value SHOULD NOT cause a preflight"
68 }
69 // Negative test cases with abnormal headers
70 ,{
71 headersToAdd: [{ name : "Accept", value: abnormalSimpleCorsHeaderValue }],
72 explicitlyAllowHeaders: false,
73 shouldCausePreflight: true,
74 description: "Accept header with abnormal value SHOULD cause a preflight"
75 }
76 ,{
77 headersToAdd: [{ name : "Accept-Language", value: abnormalSimpleCorsHeaderValue }],
78 explicitlyAllowHeaders: false,
79 shouldCausePreflight: true,
80 description: "Accept-Language header with abnormal value SHOULD cause a preflight"
81 }
82 ,{
83 headersToAdd: [{ name : "Content-Language", value: abnormalSimpleCorsHeaderValue }],
84 explicitlyAllowHeaders: false,
85 shouldCausePreflight: true,
86 description: "Content-Language header with abnormal value SHOULD cause a preflight"
87 }
88 ,{
89 headersToAdd: [{ name : "Accept", value: "text/*" }, { name : "Accept-Language", value: "en" }, { name : "Content-Language", value: abnormalSimpleCorsHeaderValue }],
90 explicitlyAllowHeaders: false,
91 shouldCausePreflight: true,
92 description: "Accept header with normal value, Accept-Language header with normal value, and Content-Language header with abnormal value SHOULD cause a preflight"
93 }
94 ,{
95 headersToAdd: [{ name : "Accept", value: "text/*" }, { name : "Accept", value: abnormalSimpleCorsHeaderValue }],
96 explicitlyAllowHeaders: false,
97 shouldCausePreflight: true,
98 description: "Accept header with normal value and then another Accept header with abnormal value SHOULD cause a preflight"
99 }
100 // Positive test cases with abnormal headers
101 ,{
102 headersToAdd: [{ name : "Accept", value: abnormalSimpleCorsHeaderValue }],
103 explicitlyAllowHeaders: true,
104 shouldCausePreflight: true,
105 description: "Accept header with abnormal value and explicitly allowed headers SHOULD be allowed"
106 }
107 ,{
108 headersToAdd: [{ name : "Content-Language", value: abnormalSimpleCorsHeaderValue }],
109 explicitlyAllowHeaders: true,
110 shouldCausePreflight: true,
111 description: "Content-Language header with abnormal value and explicitly allowed headers SHOULD be allowed"
112 }
113 ,{
114 headersToAdd: [{ name : "Accept", value: "text/*" }, { name : "Accept-Language", value: "en" }, { name : "Content-Language", value: abnormalSimpleCorsHeaderValue }],
115 explicitlyAllowHeaders: true,
116 shouldCausePreflight: true,
117 description: "Accept header with normal value, Accept-Language header with normal value, Content-Language header with abnormal value, and explicitly allowed headers SHOULD be allowed"
118 }
119 ,{
120 headersToAdd: [{ name : "Accept", value: "text/*" }, { name : "Accept", value: abnormalSimpleCorsHeaderValue }],
121 explicitlyAllowHeaders: true,
122 shouldCausePreflight: true,
123 description: "Accept header with normal value, then another Accept header with abnormal value, and explicitly allowed headers SHOULD be allowed"
124 }
125 ];
126
127 function runTestCase(testNumber) {
128 var testCase = testCases[testNumber];
129 invocation = new XMLHttpRequest();
130 if(invocation) {
131 invocation.open('GET', url + (testCase.explicitlyAllowHeaders ? "/?explicitlyAllowHeaders=true" : ""), true);
132 for (var i = 0; i < testCase.headersToAdd.length; i++) {
133 invocation.setRequestHeader(testCase.headersToAdd[i].name, testCase.headersToAdd[i].value);
134 }
135 if (testCase.shouldCausePreflight && !testCase.explicitlyAllowHeaders) {
136 invocation. testNumber);
137 } else {
138 invocation. testNumber);
139 }
140 invocation.send();
141 }
142 }
143
144 runTestCase(0);
145</script>
146</body>
147</html>