Source code
Revision control
Copy as Markdown
Other Tools
Test Info: Warnings
- This test has a WPT meta file that expects 1 subtest issues.
- This WPT test may be referenced by the following Test IDs:
- /fetch/compression-dictionary/dictionary-fetch-with-link-connect-src-nonce.tentative.https.html - WPT Dashboard Interop Dashboard
<!DOCTYPE html>
<head>
<meta charset="utf-8">
<meta name="timeout" content="long"/>
<script src="./resources/compression-dictionary-util.sub.js"></script>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<link nonce="abc" rel="compression-dictionary" href="/registration?matchingNonceFromElement">
<link nonce="def" rel="compression-dictionary" href="/registration?mismatchingNonceFromElement">
<link rel="compression-dictionary" href="/registration?missingNonceFromElement">
<script>
let blocked = [];
const observer = new ReportingObserver(reports => {
for (const report of reports) {
if (report.body.effectiveDirective === "connect-src") {
const url = new URL(report.body.blockedURL);
if (url.pathname.endsWith("registration")) {
blocked.push(url.search);
}
}
}
}, {types:["csp-violation"], buffered: true});
observer.observe();
// Link from HTTP headers are only loaded after page, so don't ever try to
// run the test before.
promise_setup(() => new Promise(resolve => {
if (document.readyState === 'complete') {
resolve();
} else {
addEventListener("load", resolve);
}
}));
promise_test(async t => {
let expectedBlocked = [
"?matchingNonceFromElement",
"?mismatchingNonceFromElement",
"?missingNonceFromElement",
"?missingNonceFromHeader",
];
await t.step_wait(_ => blocked.length >= expectedBlocked.length, "<link> violating connect-src should trigger CSP violations", 3000);
assert_array_equals(blocked.toSorted(), expectedBlocked);
}, "All <link rel=compression-dictionary> are blocked via CSP rule connect-src 'nonce-abc', even when they have a matching cryptographic nonce.");
</script>