Add test for cross-origin redirect timing (#28563)

* Add test for cross-origin redirect timing * Clear churn
web-platform-tests · Apr 18, 2021 · d563ea8 · d563ea8
1 parent d464ced
commit d563ea8
Show file tree

Hide file tree

Showing 2 changed files with 61 additions and 0 deletions.
diff --git a/common/slow-redirect.py b/common/slow-redirect.py
@@ -0,0 +1,29 @@
+import time
+
+def main(request, response):
+    """Simple handler that causes redirection.
+
+    The request should typically have two query parameters:
+    status - The status to use for the redirection. Defaults to 302.
+    location - The resource to redirect to.
+    """
+    status = 302
+    delay = 2
+    if b"status" in request.GET:
+        try:
+            status = int(request.GET.first(b"status"))
+        except ValueError:
+            pass
+
+    if b"delay" in request.GET:
+        try:
+            delay = int(request.GET.first(b"delay"))
+        except ValueError:
+            pass
+
+    response.status = status
+    time.sleep(delay)
+
+    location = request.GET.first(b"location")
+
+    response.headers.set(b"Location", location)
diff --git a/resource-timing/cross-origin-start-end-time-with-redirects.html b/resource-timing/cross-origin-start-end-time-with-redirects.html
@@ -0,0 +1,32 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<meta charset="utf-8" />
+<title>This test validates the values in resource timing for cross-origin
+redirects.</title>
+<link rel="author" title="Noam Rosenthal" href="[email protected]">
+<link rel="help" href="https://www.w3.org/TR/resource-timing-2/#sec-performanceresourcetiming"/>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/resource-loaders.js"></script>
+<script src="resources/entry-invariants.js"></script>
+</head>
+<body>
+<script>
+const {REMOTE_ORIGIN} = get_host_info();
+const delay = 2
+const blank_page = `/resource-timing/resources/blank_page_green.htm`;
+const destUrl = `/common/slow-redirect.py?delay=${delay}&location=${REMOTE_ORIGIN}/${blank_page}`;
+
+const timeBefore = performance.now()
+attribute_test(load.iframe, destUrl, entry => {
+    assert_equals(entry.startTime, entry.fetchStart, 'startTime and fetchStart should be equal');
+    assert_greater_than(entry.startTime, timeBefore, 'startTime and fetchStart should be greater than the time before fetching');
+    // See https://github.com/w3c/resource-timing/issues/264
+    assert_less_than(Math.round(entry.startTime - timeBefore), delay * 1000, 'startTime should not expose redirect delays');
+}, "Verify that cross-origin resources don't implicitly expose their redirect timings")
+
+</script>
+</body>
+</html>