1 files changed, 46 insertions, 0 deletions
diff --git a/testing/web-platform/tests/resource-timing/opaque-origin.html b/testing/web-platform/tests/resource-timing/opaque-origin.html
new file mode 100644
index 0000000000..598ee50a59
--- /dev/null
+++ b/testing/web-platform/tests/resource-timing/opaque-origin.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8" />
+<title>Resource Timing TAO - "null" and opaque origin</title>
+<link rel="author" title="Google" href="http://www.google.com/" />
+<link rel="help" href="https://www.w3.org/TR/resource-timing-2/#timing-allow-origin"/>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+</head>
+<body>
+<h1>Description</h1>
+<p>This test validates that, for a cross origin resource, the timing allow
+check algorithm will correctly distinguish between 'null' and 'Null' values in
+the Timing-Allow-Origin header. An opaque origin's serialization is the string
+"null" and the timing allow origin check needs to do a case-sensitive comparison
+to the Timing-Allow-Origin header.
+</p>
+<iframe id="frameContext"></iframe>
+<script>
+const {ORIGIN} = get_host_info();
+const url = `${ORIGIN}/resource-timing/resources/TAOResponse.py`;
+const frame_content = `data:text/html;utf8,<body>
+  <script src="${ORIGIN}/resources/testharness.js"></` + `script>
+  <script src="${ORIGIN}/resource-timing/resources/entry-invariants.js">
+  </` + `script>
+  <script>
+    attribute_test(fetch, "${url}?tao=null",
+      invariants.assert_tao_pass_no_redirect_http,
+      "An opaque origin should be authorized to see resource timings when the" +
+      "TAO header is the string 'null'");
+    attribute_test(fetch, "${url}?tao=Null",
+      invariants.assert_tao_failure_resource,
+      "An opaque origin must not be authorized to see resource timings when " +
+      "the TAO header is the string 'Null'. (The check for 'null' must be " +
+      "case-sensitive)");
+  </` + `script>
+</body>`;
+
+frameContext.style = "display:none";
+frameContext.src = frame_content;
+fetch_tests_from_window(frameContext.contentWindow);
+</script>
+</body>
+</html>