| <!DOCTYPE html> |
| <script src=/resources/testharness.js></script> |
| <script src=/resources/testharnessreport.js></script> |
| <script src=/fetch/sec-metadata/resources/helper.js></script> |
| |
| <!-- Same-origin script --> |
| <script src="https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/echo-as-script.py"></script> |
| <script> |
| test(t => { |
| t.add_cleanup(_ => { header = null; }); |
| |
| assert_header_equals(header, { |
| "dest": "script", |
| "site": "same-origin", |
| "user": "?F", |
| "mode": "no-cors", |
| }); |
| }, "Same-origin script"); |
| </script> |
| |
| <!-- Same-site script --> |
| <script src="https://{{hosts[][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/echo-as-script.py"></script> |
| <script> |
| test(t => { |
| t.add_cleanup(_ => { header = null; }); |
| |
| assert_header_equals(header, { |
| "dest": "script", |
| "site": "same-site", |
| "user": "?F", |
| "mode": "no-cors", |
| }); |
| }, "Same-site script"); |
| </script> |
| |
| <!-- Cross-site script --> |
| <script src="https://{{hosts[alt][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/echo-as-script.py"></script> |
| <script> |
| test(t => { |
| t.add_cleanup(_ => { header = null; }); |
| |
| assert_header_equals(header, { |
| "dest": "script", |
| "site": "cross-site", |
| "user": "?F", |
| "mode": "no-cors", |
| }); |
| }, "Cross-site script"); |
| </script> |
| |
| <!-- Same-origin script, CORS mode --> |
| <script src="https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/echo-as-script.py" crossorigin="anonymous"></script> |
| <script> |
| test(t => { |
| t.add_cleanup(_ => { header = null; }); |
| |
| assert_header_equals(header, { |
| "dest": "script", |
| "site": "same-origin", |
| "user": "?F", |
| "mode": "cors", |
| }); |
| }, "Same-origin CORS script"); |
| </script> |
