Source code
Revision control
Copy as Markdown
Other Tools
Test Info:
- This WPT test may be referenced by the following Test IDs:
- /xhr/setrequestheader-header-forbidden.htm - WPT Dashboard Interop Dashboard
<!doctype html>
<html>
<head>
<title>XMLHttpRequest: setRequestHeader() - headers that are forbidden</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
</head>
<body>
<div id="log"></div>
<script>
test(function() {
var client = new XMLHttpRequest()
client.open("POST", "resources/inspect-headers.py?filter_value=TEST", false)
client.setRequestHeader("Accept-Charset", "TEST")
client.setRequestHeader("Accept-Encoding", "TEST")
client.setRequestHeader("Connection", "TEST")
client.setRequestHeader("Content-Length", "TEST")
client.setRequestHeader("Cookie", "TEST")
client.setRequestHeader("Cookie2", "TEST")
client.setRequestHeader("Date", "TEST")
client.setRequestHeader("DNT", "TEST")
client.setRequestHeader("Expect", "TEST")
client.setRequestHeader("Host", "TEST")
client.setRequestHeader("Keep-Alive", "TEST")
client.setRequestHeader("Referer", "TEST")
client.setRequestHeader("TE", "TEST")
client.setRequestHeader("Trailer", "TEST")
client.setRequestHeader("Transfer-Encoding", "TEST")
client.setRequestHeader("Upgrade", "TEST")
client.setRequestHeader("Via", "TEST")
client.setRequestHeader("Proxy-", "TEST")
client.setRequestHeader("Proxy-LIES", "TEST")
client.setRequestHeader("Proxy-Authorization", "TEST")
client.setRequestHeader("Sec-", "TEST")
client.setRequestHeader("Sec-X", "TEST")
client.send(null)
assert_equals(client.responseText, "")
})
test (function() {
let forbiddenMethods = [
"TRACE",
"TRACK",
"CONNECT",
"trace",
"track",
"connect",
"trace,",
"GET,track ",
" connect",
];
let overrideHeaders = [
"x-http-method-override",
"x-http-method",
"x-method-override",
"X-HTTP-METHOD-OVERRIDE",
"X-HTTP-METHOD",
"X-METHOD-OVERRIDE",
];
for (forbiddenMethod of forbiddenMethods) {
for (overrideHeader of overrideHeaders) {
var client = new XMLHttpRequest()
client.open("POST",
`resources/inspect-headers.py?filter_value=${forbiddenMethod}`, false)
client.setRequestHeader(overrideHeader, forbiddenMethod)
client.send(null)
assert_equals(client.responseText, "")
}
}
let permittedValues = [
"GETTRACE",
"GET",
"\",TRACE\",",
];
for (permittedValue of permittedValues) {
for (overrideHeader of overrideHeaders) {
var client = new XMLHttpRequest()
client.open("POST",
`resources/inspect-headers.py?filter_name=${overrideHeader}`, false)
client.setRequestHeader(overrideHeader, permittedValue)
client.send(null)
assert_equals(client.responseText, overrideHeader + ": " + permittedValue + "\n")
}
}
})
</script>
</body>
</html>