Content - 8ef583106c08dec4f34769b68196961f3e012db5 - f6cf967/x-frame-options/deny.sub.html

visit type:

Tip revision: 930e144a5b889a9c0251d99a01a86df5dd5610b8 authored by Ben Kelly on 11 April 2018, 09:35:46 UTC
Add a WPT test to verify dedicated workers have a separate client ID from their owning document.

Tip revision: 930e144

deny.sub.html

<!DOCTYPE html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="./support/helper.js"></script>
<body>
<script>
  async_test(t => {
    var i = document.createElement('iframe');
    i.src = "./support/xfo.py?value=DENY";

    assert_no_message_from(i, t);

    i.onload = t.step_func_done(_ => {
      assert_throws("SecurityError", function () { return i.contentDocument; });
      i.remove();
    });

    document.body.appendChild(i);
  }, "`XFO: DENY` blocks same-origin framing.");

  async_test(t => {
    var i = document.createElement('iframe');
    i.src = "http://{{domains[www]}}:{{ports[http][0]}}/x-frame-options/support/xfo.py?value=DENY";

    assert_no_message_from(i, t);

    i.onload = t.step_func_done(_ => {
      assert_throws("SecurityError", function () { return i.contentDocument; });
      i.remove();
    });

    document.body.appendChild(i);
  }, "`XFO: DENY` blocks cross-origin framing.");
</script>

Browse the archive

https://github.com/web-platform-tests/wpt