Changeset 47873 in webkit

Timestamp:

Aug 28, 2009 2:16:54 PM (15 years ago)

Author:

jparent@chromium.org

Message:

set-dangerous-headers.html shouldn't set allowed header to same value
as forbidden headers. AUTHORIZATION is an allowed header, and the
value is being set to "foobar" like the forbidden headers, which causes
the test to fail when run using http server that doesn't strip the
AUTHORIZATION header.
​https://bugs.webkit.org/show_bug.cgi?id=28818

Patch by Julie Parent <​jparent@chromium.org> on 2009-08-28
Reviewed by Alexey Proskuryakov.

• http/tests/xmlhttprequest/set-dangerous-headers.html:

Location:

trunk/LayoutTests

Files:

• ChangeLog (modified) (1 diff)
• http/tests/xmlhttprequest/set-dangerous-headers.html (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-08-28  Julie Parent  <jparent@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        set-dangerous-headers.html shouldn't set allowed header to same value
+        as forbidden headers.  AUTHORIZATION is an allowed header, and the
+        value is being set to "foobar" like the forbidden headers, which causes
+        the test to fail when run using http server that doesn't strip the
+        AUTHORIZATION header.
+        https://bugs.webkit.org/show_bug.cgi?id=28818
+
+        * http/tests/xmlhttprequest/set-dangerous-headers.html:
+
 2009-08-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
 

trunk/LayoutTests/http/tests/xmlhttprequest/set-dangerous-headers.html

@@ -14 +14 @@
     req.setRequestHeader("ACCESS-CONTROL-REQUEST-HEADERS", "foobar");
     req.setRequestHeader("ACCESS-CONTROL-REQUEST-METHOD", "foobar");
-    req.setRequestHeader("AUTHORIZATION", "foobar");
+    // AUTHORIZATION is no longer forbidden. See
+    // https://bugs.webkit.org/show_bug.cgi?id=24957 for more details. Set to
+    // a value other than the foobar since some http servers (lighttp) do not
+    // strip this out (Apache does).
+    req.setRequestHeader("AUTHORIZATION", "baz");
     req.setRequestHeader("CONNECTION", "foobar");
     req.setRequestHeader("CONTENT-LENGTH", "123456");