<!DOCTYPE html>
<html>
<head>
<script>
if (window.testRunner) {
  testRunner.dumpAsText();
  testRunner.dumpChildFramesAsText();
}
</script>
</head>
<body>
  <p>
    This script should not execute even through the second CSP header would allow it.
  </p>
  <iframe src="http://127.0.0.1:8000/security/contentSecurityPolicy/resources/echo-multiple-headers.pl?should_run=no&q=http://localhost:8000/security/contentSecurityPolicy/resources/script.js&csp1=default-src%20'self'&csp2=allow%20*"></iframe>
</body>
</html>