1 files changed, 43 insertions, 0 deletions
diff --git a/testing/web-platform/tests/portals/xfo/portals-xfo-deny.sub.html b/testing/web-platform/tests/portals/xfo/portals-xfo-deny.sub.html
new file mode 100644
index 0000000000..efc925276c
--- /dev/null
+++ b/testing/web-platform/tests/portals/xfo/portals-xfo-deny.sub.html
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+<script>
+// TODO(jbroman): Ideally these would also check that the portal element gets a
+// completion event.
+
+async_test(t => {
+  assert_implements("HTMLPortalElement" in self);
+  var portal = document.createElement('portal');
+  portal.src = "/portals/xfo/resources/xfo-deny.asis";
+  portal.onmessage = t.unreached_func("should not have received a message");
+  document.body.appendChild(portal);
+  t.add_cleanup(() => portal.remove());
+  t.step_timeout(() => t.done(), 2000);
+}, "`XFO: DENY` blocks same-origin portals.");
+
+async_test(t => {
+  assert_implements("HTMLPortalElement" in self);
+  var portal = document.createElement('portal');
+  portal.src = "http://{{domains[www]}}:{{ports[http][0]}}/portals/xfo/resources/xfo-deny.asis";
+  portal.onmessage = t.unreached_func("should not have received a message");
+  document.body.appendChild(portal);
+  t.add_cleanup(() => portal.remove());
+  t.step_timeout(() => t.done(), 2000);
+}, "`XFO: DENY` blocks cross-origin portals.");
+
+async_test(t => {
+  assert_implements("HTMLPortalElement" in self);
+  var portal = document.createElement('portal');
+  portal.src = "/portals/xfo/resources/xfo-deny.asis";
+  portal.onmessage = t.unreached_func("should not have received a message");
+  document.body.appendChild(portal);
+  t.add_cleanup(() => portal.remove());
+  t.step_timeout(async () => {
+    await promise_rejects_dom(t, 'InvalidStateError', portal.activate());
+    t.done();
+  }, 2000);
+}, "Portals blocked by `XFO: DENY` cannot be activated.");
+</script>
+</body>