-
Notifications
You must be signed in to change notification settings - Fork 1.2k
/
set-dangerous-headers.html
57 lines (52 loc) · 2.25 KB
/
set-dangerous-headers.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
<html>
<body>
<p>Test that setRequestHeader cannot be used to alter security-sensitive headers.</p>
<pre id=result>FAIL: script didn't run or raised an unexpected exception.</pre>
<script>
if (window.testRunner)
testRunner.dumpAsText();
req = new XMLHttpRequest;
req.open("GET", "resources/print-headers.cgi", false);
req.setRequestHeader("ACCEPT-CHARSET", "foobar");
req.setRequestHeader("ACCEPT-ENCODING", "foobar");
req.setRequestHeader("ACCESS-CONTROL-REQUEST-HEADERS", "foobar");
req.setRequestHeader("ACCESS-CONTROL-REQUEST-METHOD", "foobar");
// AUTHORIZATION is no longer forbidden. See
// https://bugs.webkit.org/show_bug.cgi?id=24957 for more details. Set to
// a value other than the foobar since some http servers (lighttp) do not
// strip this out (Apache does).
req.setRequestHeader("AUTHORIZATION", "baz");
req.setRequestHeader("CONNECTION", "foobar");
req.setRequestHeader("CONTENT-LENGTH", "123456");
req.setRequestHeader("COOKIE", "foobar");
req.setRequestHeader("COOKIE2", "foobar");
req.setRequestHeader("DATE", "foobar");
req.setRequestHeader("DNT", "foobar");
req.setRequestHeader("EXPECT", "100-continue");
req.setRequestHeader("HOST", "foobar");
req.setRequestHeader("KEEP-ALIVE", "foobar");
req.setRequestHeader("ORIGIN", "foobar");
req.setRequestHeader("REFERER", "foobar");
req.setRequestHeader("TE", "foobar");
req.setRequestHeader("TRAILER", "foobar");
req.setRequestHeader("TRANSFER-ENCODING", "foobar");
req.setRequestHeader("UPGRADE", "foobar");
req.setRequestHeader("VIA", "foobar");
req.setRequestHeader("Proxy-", "foobar");
req.setRequestHeader("Proxy-test", "foobar");
req.setRequestHeader("PROXY-FOO", "foobar");
req.setRequestHeader("Sec-", "foobar");
req.setRequestHeader("Sec-test", "foobar");
req.setRequestHeader("SEC-FOO", "foobar");
try {
req.send("");
if (req.responseText.match("100-continue|foobar|123456"))
document.getElementById("result").textContent = req.responseText;
else
document.getElementById("result").textContent = "SUCCESS";
} catch (ex) {
document.getElementById("result").textContent = ex;
}
</script>
</body>
</html>