http/tests/xmlhttprequest/get-dangerous-headers.html

<html>
<body>
<p>Test that getResponseHeader and getAllResponseHeaders cannot be used to get the cookie header fields.</p>
<pre id="result">FAIL: Script didn't run or raised an unexpected exception.</pre>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    req = new XMLHttpRequest;
    req.open("POST", "resources/get-set-cookie.cgi", false);
    req.send("");

    var result = "PASS";

    if (req.getResponseHeader("Set-Cookie") != null && result == "PASS")
        result = "FAIL: Saw a Set-Cookie header with getResponseHeader.";
    if (req.getResponseHeader("set-cookie") != null && result == "PASS")
        result = "FAIL: Saw a set-cookie header with getResponseHeader.";
    if (req.getResponseHeader("Set-Cookie2") != null && result == "PASS")
        result = "FAIL: Saw a Set-Cookie2 header with getResponseHeader.";
    if (req.getResponseHeader("set-cookie2") != null && result == "PASS")
        result = "FAIL: Saw a set-cookie2 header with getResponseHeader.";

    if (req.getAllResponseHeaders().match(/Set-Cookie/) && result == "PASS")
        result = "FAIL: Saw Set-Cookie with getAllResponseHeaders.";
    if (req.getAllResponseHeaders().match(/set-cookie/) && result == "PASS")
        result = "FAIL: Saw set-cookie with getAllResponseHeaders.";
    if (req.getAllResponseHeaders().match(/Set-Cookie2/) && result == "PASS")
        result = "FAIL: Saw Set-Cookie2 with getAllResponseHeaders.";
    if (req.getAllResponseHeaders().match(/set-cookie2/) && result == "PASS")
        result = "FAIL: Saw set-cookie2 with getAllResponseHeaders.";

    document.getElementById("result").textContent = result;
</script>
</body>
</html>