tests/ceftests/cors_unittest.cc
// XHR and fetch requests behave the same, except for console message contents.
// In addition to basic CORS header behaviors and request blocking, this test
// verifies that CORS preflight requests are sent and received when expected.
// Since preflight behavior is implemented in the network process we expect it
// to already have substantial test coverage in Chromium.
XHR and fetch requests behave the same, except for console message contents.
In addition to basic CORS header behaviors and request blocking, this test
verifies that CORS preflight requests are sent and received when expected.
Since preflight behavior is implemented in the network process we expect it
to already have substantial test coverage in Chromium.
XHR and fetch requests behave the same except for console message contents . In addition to basic CORS header behaviors and request blocking this test verifies that CORS preflight requests are sent and received when expected . Since preflight behavior is implemented in the network process we expect it to already have substantial test coverage in Chromium .
void SetupExecRequest(ExecMode mode,
                      CookieTestSetup* setup,
                      const std::string& test_name,
                      HandlerType main_handler,
                      CookieResource* main_resource,
                      HandlerType sub_handler,
                      SubResource* sub_resource,
                      PreflightResource* preflight_resource,
                      bool add_header) {
  const std::string& base_path = "/" + test_name;
  const std::string& sub_path = base_path + ".sub.txt";
  sub_resource->Init(sub_handler, sub_path, kMimeTypeText, kDefaultText);
  sub_resource->InitCors(main_handler, add_header);
  const std::string& sub_url = sub_resource->GetPathURL();
  main_resource->Init(main_handler, base_path, kMimeTypeHtml,
                      GetExecMainHtml(mode, sub_url));
  SetupCookieExpectations(setup, main_resource, sub_resource);
  const bool expect_cors_preflight =
      sub_resource->is_cross_origin && sub_handler == HandlerType::SERVER;
  if (sub_resource->is_cross_origin &&
      (!sub_resource->supports_cors || !add_header)) {
    main_resource->expected_failure_query_ct = 1;
    if (sub_resource->supports_cors && !add_header) {
      if (!expect_cors_preflight || preflight_resource != nullptr) {
        if (mode == ExecMode::XHR) {
          setup->AddConsoleMessage(
              "Access to XMLHttpRequest at '" + sub_url + "' from origin '" +
              sub_resource->main_origin +
              "' has been blocked by CORS policy: No "
              "'Access-Control-Allow-Origin' "
              "header is present on the requested resource.");
        } else {
          setup->AddConsoleMessage(
              "Access to fetch at '" + sub_url + "' from origin '" +
              sub_resource->main_origin +
              "' has been blocked by CORS policy: No "
              "'Access-Control-Allow-Origin' header is present on the "
              "requested "
              "resource. If an opaque response serves your needs, set the "
              "request's mode to 'no-cors' to fetch the resource with CORS "
              "disabled.");
        }
      }
    } else if (mode == ExecMode::XHR) {
      setup->AddConsoleMessage(
          "Access to XMLHttpRequest at '" + sub_url + "' from origin '" +
          sub_resource->main_origin +
          "' has been blocked by CORS policy: Cross origin requests are only "
          "supported for protocol schemes:");
    } else {
      setup->AddConsoleMessage("Fetch API cannot load " + sub_url +
                               ". URL scheme \"" + GetScheme(sub_handler) +
                               "\" is not supported.");
    }
  } else {
    main_resource->expected_success_query_ct = 1;
  }
  setup->AddResource(main_resource);
  setup->AddResource(sub_resource);
  if (expect_cors_preflight) {
    if (preflight_resource) {
      preflight_resource->Init(sub_handler, sub_path, kMimeTypeText,
                               std::string());
      preflight_resource->InitPreflight(main_handler);
      setup->AddResource(preflight_resource);
    } else {
      main_resource->expected_failure_query_ct = 1;
      main_resource->expected_success_query_ct = 0;
      sub_resource->expected_response_ct = 0;
      if (mode == ExecMode::XHR) {
        setup->AddConsoleMessage(
            "Access to XMLHttpRequest at '" + sub_url + "' from origin '" +
            sub_resource->main_origin +
            "' has been blocked by CORS policy: Response to preflight request "
            "doesn't pass access control check: No "
            "'Access-Control-Allow-Origin' header is present on the requested "
            "resource.");
      } else {
        setup->AddConsoleMessage(
            "Access to fetch at '" + sub_url + "' from origin '" +
            sub_resource->main_origin +
            "' has been blocked by CORS policy: Response to preflight request "
            "doesn't pass access control check: No "
            "'Access-Control-Allow-Origin' header is present on the requested "
            "resource. If an opaque response serves your needs, set the "
            "request's mode to 'no-cors' to fetch the resource with CORS "
            "disabled.");
      }
    }
  }
}
void SetupExecRequest ( ExecMode mode , CookieTestSetup * setup , const std :: string & test_name , HandlerType main_handler , CookieResource * main_resource , HandlerType sub_handler , SubResource * sub_resource , PreflightResource * preflight_resource , bool add_header ) { const std :: string & base_path = " " + test_name ; const std :: string & sub_path = base_path + " " ; sub_resource -> Init ( sub_handler , sub_path , kMimeTypeText , kDefaultText ) ; sub_resource -> InitCors ( main_handler , add_header ) ; const std :: string & sub_url = sub_resource -> GetPathURL ( ) ; main_resource -> Init ( main_handler , base_path , kMimeTypeHtml , GetExecMainHtml ( mode , sub_url ) ) ; SetupCookieExpectations ( setup , main_resource , sub_resource ) ; const bool expect_cors_preflight = sub_resource -> is_cross_origin && sub_handler == HandlerType :: SERVER ; if ( sub_resource -> is_cross_origin && ( ! sub_resource -> supports_cors || ! add_header ) ) { main_resource -> expected_failure_query_ct = 1 ; if ( sub_resource -> supports_cors && ! add_header ) { if ( ! expect_cors_preflight || preflight_resource != nullptr ) { if ( mode == ExecMode :: XHR ) { setup -> AddConsoleMessage ( " " + sub_url + " " + sub_resource -> main_origin + " " " " " " ) ; } else { setup -> AddConsoleMessage ( " " + sub_url + " " + sub_resource -> main_origin + " " " " " " " " " " " " ) ; } } } else if ( mode == ExecMode :: XHR ) { setup -> AddConsoleMessage ( " " + sub_url + " " + sub_resource -> main_origin + " " " " ) ; } else { setup -> AddConsoleMessage ( " " + sub_url + " \" " + GetScheme ( sub_handler ) + " \" " ) ; } } else { main_resource -> expected_success_query_ct = 1 ; } setup -> AddResource ( main_resource ) ; setup -> AddResource ( sub_resource ) ; if ( expect_cors_preflight ) { if ( preflight_resource ) { preflight_resource -> Init ( sub_handler , sub_path , kMimeTypeText , std :: string ( ) ) ; preflight_resource -> InitPreflight ( main_handler ) ; setup -> AddResource ( preflight_resource ) ; } else { main_resource -> expected_failure_query_ct = 1 ; main_resource -> expected_success_query_ct = 0 ; sub_resource -> expected_response_ct = 0 ; if ( mode == ExecMode :: XHR ) { setup -> AddConsoleMessage ( " " + sub_url + " " + sub_resource -> main_origin + " " " " " " " " ) ; } else { setup -> AddConsoleMessage ( " " + sub_url + " " + sub_resource -> main_origin + " " " " " " " " " " " " ) ; } } } }
XHR and fetch requests behave the same, except for console message contents.
XHR and fetch requests behave the same except for console message contents .
// Expect a single xhr request. // Expect a single main frame request. // Cross-origin requests to a server sub-resource will receive a CORS // preflight request because we add an unsafe header. // Expect the cross-origin XHR to be blocked. // The request supports CORS, but we didn't add the // "Access-Control-Allow-Origin" header. // This is the error message when not expecting a CORS preflight // request, or when the preflight request is handled by the server. // Unhandled preflight requests will output a different error message // (see below). // Expect the (possibly cross-origin) XHR to be allowed. // Expect a CORS preflight request. // The server will handle the preflight request. The cross-origin XHR may // still be blocked if the "Access-Control-Allow-Origin" header is missing // (see above). // The server will not handle the preflight request. Expect the // cross-origin XHR to be blocked.