1 files changed, 46 insertions, 0 deletions
diff --git a/testing/web-platform/tests/resource-timing/TAO-port-mismatch-means-crossorigin.html b/testing/web-platform/tests/resource-timing/TAO-port-mismatch-means-crossorigin.html
new file mode 100644
index 0000000000..f1218d17a0
--- /dev/null
+++ b/testing/web-platform/tests/resource-timing/TAO-port-mismatch-means-crossorigin.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8" />
+<title>TAO - port mismatch must fail the check</title>
+<link rel="author" title="Google" href="http://www.google.com/" />
+<link rel="help" href="https://www.w3.org/TR/resource-timing-2/#sec-timing-allow-origin"/>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/entry-invariants.js"></script>
+<script>
+
+const {ORIGINAL_HOST, PORT, PORT2} = get_host_info();
+
+// The main page is being requested on the default port (PORT), while the
+// subresource will be requested on a separate port (PORT2). The response will
+// have a Timing-Allow-Origin header value with the second port so this page's
+// origin should not be a match.
+const port_mismatch_url = `${location.protocol}//${ORIGINAL_HOST}:${PORT2}` +
+                          `/resource-timing/resources/TAOResponse.py?` +
+                          `tao=origin_port_${PORT2}`;
+attribute_test(
+  fetch, port_mismatch_url, invariants.assert_tao_failure_resource,
+  "A port mismatch must fail the TAO check");
+
+// The same URL as above except the Timing-Allow-Origin header will have the
+// same port as this page's origin. Therefore, this page's origin will match
+// the Timing-Allow-Origin header's value. Therefore, the subresource's timings
+// must be exposed.
+const port_match_url = `${location.protocol}//${ORIGINAL_HOST}:${PORT2}` +
+                       `/resource-timing/resources/TAOResponse.py?` +
+                       `tao=origin_port_${PORT}`;
+attribute_test(
+  fetch, port_match_url, invariants.assert_tao_pass_no_redirect_http,
+  "An identical port must pass the TAO check");
+
+</script>
+</head>
+<body>
+<h1>Description</h1>
+<p>This test validates that for a cross origin resource with different ports,
+the timing allow check algorithm will fail when the value of
+Timing-Allow-Origin value has the right host but the wrong port in it.</p>
+</body>
+</html>