dom/base/test/test_bug466080.html

   1 <!DOCTYPE HTML>
   2 <html>
   3 <head>
   4   <title>Test bug 466080</title>
   5   <script src="/tests/SimpleTest/SimpleTest.js"></script>
   6   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
   7 </head>
   8 <body>
   9 <iframe id="frame1"
  10         src="https://requireclientcert.example.com/tests/dom/base/test/bug466080.sjs">
  11
  12  This iframe should load the resource via the src-attribute from
  13  a secure server which requires a client-cert. Doing this is
  14  supposed to work, but further below in the test we try to load
  15  the resource from the same url using a XHR, which should not work.
  16
  17  TODO : What if we change 'src' from JS? Would/should it load?
  18
  19 </iframe>
  20
  21 <script class="testbody" type="text/javascript">
  22
  23 "use strict";
  24
  25 onWindowLoad();
  26
  27 let alltests = [
  28
  29 // load resource from a relative url - this should work
  30   { url:"bug466080.sjs",
  31     status_check:"==200",
  32     error:"XHR from relative URL"},
  33
  34 // TODO - load the resource from a relative url via https..?
  35
  36 // load a non-existing resource - should get "404 Not Found"
  37   { url:"bug466080-does-not.exist",
  38     status_check:"==404",
  39     error:"XHR loading non-existing resource"},
  40
  41 // load resource from cross-site non-secure server
  42   { url:"http://test1.example.com/tests/dom/base/test/bug466080.sjs",
  43     status_check:"==200",
  44     error:"XHR from cross-site plaintext server"},
  45
  46 // load resource from cross-site secure server - should work since no credentials are needed
  47   { url:"https://test1.example.com/tests/dom/base/test/bug466080.sjs",
  48     status_check:"==200",
  49     error:"XHR from cross-site secure server"},
  50
  51 // load resource from cross-site secure server - should work since the server just requests certs
  52   { url:"https://requestclientcert.example.com/tests/dom/base/test/bug466080.sjs",
  53     status_check:"==200",
  54     error:"XHR from cross-site secure server requesting certificate"},
  55
  56 // load resource from cross-site secure server - should NOT work since the server requires cert
  57 // note that this is the url which is used in the iframe.src above
  58   { url:"https://requireclientcert.example.com/tests/dom/base/test/bug466080.sjs",
  59     status_check:"!=200",
  60     error:"XHR from cross-site secure server requiring certificate"},
  61
  62 // repeat previous,  - should NOT work
  63   { url:"https://requireclientcert.example.com/tests/dom/base/test/bug466080.sjs",
  64     status_check:"==200",
  65     error:"XHR w/ credentials from cross-site secure server requiring certificate",
  66     withCredentials:"true"},
  67
  68 // repeat previous, but with credentials - should work
  69   { url:"https://requireclientcert.example.com/tests/dom/base/test/bug466080.sjs",
  70     status_check:"==200",
  71     error:"XHR w/ credentials from cross-site secure server requiring certificate",
  72     withCredentials:"true"},
  73
  74 // repeat previous, withCredentials but using a weird method to force preflight
  75 // should NOT work since our preflight is anonymous and will fail with our simple server
  76   { url:"https://requireclientcert.example.com/tests/dom/base/test/bug466080.sjs",
  77     status_check:"!=200",
  78     error:"XHR PREFLIGHT from cross-site secure server requiring certificate",
  79     withCredentials:"true",
  80     method:"XMETHOD"},
  81
  82 // repeat previous, withCredentials but using a weird method to force preflight
  83 // Set network.cors_preflight.allow_client_cert pref, that will allow cers on an
  84 // anonymous connection.
  85 // This should work since our preflight will work now.
  86   { url:"https://requireclientcert.example.com/tests/dom/base/test/bug466080.sjs",
  87     status_check:"==200",
  88     error:"XHR PREFLIGHT from cross-site secure server requiring certificate",
  89     withCredentials:"true",
  90     method:"XMETHOD",
  91     enableCertOnPreflight: true},
  92
  93   { cleanEnableCertOnPreflight: true},
  94 ];
  95
  96 async function onWindowLoad() {
  97     // First, check that resource was loaded into the iframe
  98     // This check in fact depends on bug #444165... :)
  99     await new Promise(resolve => {
 100         document.getElementById("frame1").onload = () => { resolve(); };
 101     });
 102
 103     async function runTest(test) {
 104         if (test.cleanEnableCertOnPreflight) {
 105             await SpecialPowers.pushPrefEnv({"set": [["network.cors_preflight.allow_client_cert", false]]});
 106             if (!alltests.length) {
 107                 SimpleTest.finish();
 108             } else {
 109                 runTest(alltests.shift());
 110             }
 111         } else {
 112             if (test.enableCertOnPreflight != null) {
 113                 await SpecialPowers.pushPrefEnv({"set": [["network.cors_preflight.allow_client_cert", true]]});
 114             }
 115             var xhr =  new XMLHttpRequest();
 116
 117             var method = "GET";
 118             if (test.method != null) { method = test.method; }
 119             xhr.open(method, test.url);
 120
 121             xhr.withCredentials = test.withCredentials;
 122
 123             SpecialPowers.wrap(xhr).setRequestHeader("Connection", "Keep-Alive", false);
 124
 125             try {
 126                 xhr.send();
 127             } catch(e) {
 128             }
 129
 130             xhr.onloadend = function() {
 131                 // eslint-disable-next-line no-eval
 132                 var success = eval(xhr.status + test.status_check);
 133                 ok(success, test.error);
 134
 135                 if (!alltests.length) {
 136                     SimpleTest.finish();
 137                 } else {
 138                     runTest(alltests.shift());
 139                 }
 140             };
 141         }
 142     }
 143
 144     runTest(alltests.shift());
 145 }
 146
 147 SimpleTest.waitForExplicitFinish();
 148
 149 </script>
 150 </body>
 151 </html>