<!DOCTYPE html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<body>
<script>
  testRunner.dumpFrameLoadCallbacks();

  async_test(t => {
    fetch("https://hsts-example.test:8443/security/resources/hsts.php?as-fetch")
      .then(t.step_func(_ => {
        var i = document.createElement('iframe');

        // Note: HTTP, not HTTPS:
        i.src = "http://hsts-example.test:8443/security/resources/hsts.php";
        window.onmessage = t.unreached_func("No message should be received from the frame.");

        // Give the message a chance to get through.
        document.body.appendChild(i);
        requestAnimationFrame(_ => t.done());
      }));
  }, "HSTS does not bypass MIX.");
</script>