Content - 8ef583106c08dec4f34769b68196961f3e012db5 - dba4349/x-frame-options/deny.sub.html

visit type:

Tip revision: 4b97ac70bda81f089de42e3dbe4a10e505a6436d authored by Philip Jägenstedt on 25 January 2018, 12:55:18 UTC
Merge remote-tracking branch 'origin/master' into annevk/meta-global

Tip revision: 4b97ac7

deny.sub.html

<!DOCTYPE html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="./support/helper.js"></script>
<body>
<script>
  async_test(t => {
    var i = document.createElement('iframe');
    i.src = "./support/xfo.py?value=DENY";

    assert_no_message_from(i, t);

    i.onload = t.step_func_done(_ => {
      assert_throws("SecurityError", function () { return i.contentDocument; });
      i.remove();
    });

    document.body.appendChild(i);
  }, "`XFO: DENY` blocks same-origin framing.");

  async_test(t => {
    var i = document.createElement('iframe');
    i.src = "http://{{domains[www]}}:{{ports[http][0]}}/x-frame-options/support/xfo.py?value=DENY";

    assert_no_message_from(i, t);

    i.onload = t.step_func_done(_ => {
      assert_throws("SecurityError", function () { return i.contentDocument; });
      i.remove();
    });

    document.body.appendChild(i);
  }, "`XFO: DENY` blocks cross-origin framing.");
</script>

Browse the archive

https://github.com/web-platform-tests/wpt