TAO-port-mismatch-means-crossorigin.html

Enable keyboard shortcuts

This WPT test may be referenced by the following Test IDs:
- /resource-timing/TAO-port-mismatch-means-crossorigin.html - WPT Dashboard Interop Dashboard

<!DOCTYPE html>

<html>

<head>

<meta charset="utf-8" />

<title>TAO - port mismatch must fail the check</title>

<link rel="author" title="Google" href="http://www.google.com/" />

<link rel="help" href="https://www.w3.org/TR/resource-timing-2/#sec-timing-allow-origin"/>

<script src="/resources/testharness.js"></script>

<script src="/resources/testharnessreport.js"></script>

<script src="/common/get-host-info.sub.js"></script>

<script src="resources/entry-invariants.js"></script>

<script>

const {ORIGINAL_HOST, PORT, PORT2} = get_host_info();

// The main page is being requested on the default port (PORT), while the

// subresource will be requested on a separate port (PORT2). The response will

// have a Timing-Allow-Origin header value with the second port so this page's

// origin should not be a match.

const port_mismatch_url = `${location.protocol}//${ORIGINAL_HOST}:${PORT2}` +

                          `/resource-timing/resources/TAOResponse.py?` +

                          `tao=origin_port_${PORT2}`;

attribute_test(

  fetch, port_mismatch_url, invariants.assert_tao_failure_resource,

  "A port mismatch must fail the TAO check");

// The same URL as above except the Timing-Allow-Origin header will have the

// same port as this page's origin. Therefore, this page's origin will match

// the Timing-Allow-Origin header's value. Therefore, the subresource's timings

// must be exposed.

const port_match_url = `${location.protocol}//${ORIGINAL_HOST}:${PORT2}` +

                       `/resource-timing/resources/TAOResponse.py?` +

                       `tao=origin_port_${PORT}`;

attribute_test(

  fetch, port_match_url, invariants.assert_tao_pass_no_redirect_http,

  "An identical port must pass the TAO check");

</script>

</head>

<body>

<h1>Description</h1>

<p>This test validates that for a cross origin resource with different ports,

the timing allow check algorithm will fail when the value of

Timing-Allow-Origin value has the right host but the wrong port in it.</p>

</body>

</html>