Attachment 276738 Details for Bug 156753 – Patch

[patch] Patch

bug-156753-20160419205652.patch (text/plain), 119.15 KB, created by youenn fablet on 2016-04-19 11:56:34 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: youenn fablet

Created: 2016-04-19 11:56:34 PDT

Size: 119.15 KB

patch

obsolete

>Subversion Revision: 199708
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 755ff0bca62a4a5fa7bf7801d05a79a25afe24ad..903dad392a529cb957015320cff24632debb986f 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,41 @@
>+2016-04-19  Youenn Fablet  <youenn.fablet@crf.canon.fr>
>+
>+        [Fetch API] Add support for fetch mode, in particular cors
>+        https://bugs.webkit.org/show_bug.cgi?id=156753
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Tests: imported/w3c/web-platform-tests/fetch/api/cors/cors-basic-worker.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-basic.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies-worker.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering-worker.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins-worker.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-worker.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-origin-worker.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-origin.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect-worker.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer-worker.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status-worker.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-worker.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-worker.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-worker.html
>+               imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect.html
>+
>+        * Modules/fetch/FetchLoader.cpp:
>+        (WebCore::FetchLoader::start): Setting loader CORS option according fetch mode.
>+        (WebCore::FetchLoader::didFailAccessControlCheck): Returning an empty response if CORS is activated.
>+        (WebCore::FetchLoader::didFailRedirectCheck): Ditto.
>+        * Modules/fetch/FetchLoader.h:
>+
> 2016-04-18  Brady Eidson  <beidson@apple.com>
> 
>         Modern IDB (Blob support): When reading Blobs from the database, grant the Networking process sandbox access to the files.
>diff --git a/Source/WebCore/Modules/fetch/FetchLoader.cpp b/Source/WebCore/Modules/fetch/FetchLoader.cpp
>index c21525f79c9060264d600831aca2f46edda2d0df..db2be7d894fc9867f2e692a4eac326bf126d36d0 100644
>--- a/Source/WebCore/Modules/fetch/FetchLoader.cpp
>+++ b/Source/WebCore/Modules/fetch/FetchLoader.cpp
>@@ -36,6 +36,7 @@
> #include "FetchLoaderClient.h"
> #include "FetchRequest.h"
> #include "ResourceRequest.h"
>+#include "ResourceResponse.h"
> #include "ScriptExecutionContext.h"
> #include "SecurityOrigin.h"
> #include "SharedBuffer.h"
>@@ -80,7 +81,14 @@ void FetchLoader::start(ScriptExecutionContext& context, const FetchRequest& req
>     options.setDataBufferingPolicy(DoNotBufferData);
>     options.preflightPolicy = ConsiderPreflight;
>     options.setAllowCredentials(AllowStoredCredentials);
>-    options.crossOriginRequestPolicy = DenyCrossOriginRequests;
>+
>+    if (request.fetchOptions().mode() == FetchOptions::Mode::SameOrigin) {
>+        m_shouldCatchCrossOriginFailures = false;
>+        options.crossOriginRequestPolicy = DenyCrossOriginRequests;
>+    } else {
>+        options.crossOriginRequestPolicy = UseAccessControl;
>+        options.securityOrigin = context.securityOrigin();
>+    }
>     options.contentSecurityPolicyEnforcement = ContentSecurityPolicyEnforcement::DoNotEnforce;
> 
>     m_loader = ThreadableLoader::create(&context, this, request.internalRequest(), options);
>@@ -145,9 +153,24 @@ void FetchLoader::didFail(const ResourceError&)
>     m_client.didFail();
> }
> 
>+void FetchLoader::didFailAccessControlCheck(const ResourceError&)
>+{
>+    if (m_shouldCatchCrossOriginFailures) {
>+        m_client.didFail();
>+        return;
>+    }
>+    didReceiveResponse(0, ResourceResponse());
>+    didFinishLoading(0, 0);
>+}
>+
> void FetchLoader::didFailRedirectCheck()
> {
>-    m_client.didFail();
>+    if (m_shouldCatchCrossOriginFailures) {
>+        m_client.didFail();
>+        return;
>+    }
>+    didReceiveResponse(0, ResourceResponse());
>+    didFinishLoading(0, 0);
> }
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/Modules/fetch/FetchLoader.h b/Source/WebCore/Modules/fetch/FetchLoader.h
>index b725e351aebf7969e6ce4ae52bba9ab53c6a9902..6c9a32d9e490c6a4ca8d6212467d4811d64d0b95 100644
>--- a/Source/WebCore/Modules/fetch/FetchLoader.h
>+++ b/Source/WebCore/Modules/fetch/FetchLoader.h
>@@ -63,6 +63,7 @@ private:
>     void didFinishLoading(unsigned long, double) final;
>     void didFail(const ResourceError&) final;
>     void didFailRedirectCheck() final;
>+    void didFailAccessControlCheck(const ResourceError&) final;
> 
>     Type type() const { return m_type; }
> 
>@@ -72,6 +73,7 @@ private:
>     RefPtr<ThreadableLoader> m_loader;
>     RefPtr<SharedBuffer> m_data;
>     bool m_isStarted { false };
>+    bool m_shouldCatchCrossOriginFailures { true };
> };
> 
> } // namespace WebCore
>diff --git a/LayoutTests/imported/w3c/ChangeLog b/LayoutTests/imported/w3c/ChangeLog
>index 48083dcd4942918f91b80520d34ca9db3dead72b..7e31b9f4375f87e4a42ab510108131015c7c6037 100644
>--- a/LayoutTests/imported/w3c/ChangeLog
>+++ b/LayoutTests/imported/w3c/ChangeLog
>@@ -1,3 +1,94 @@
>+2016-04-19  Youenn Fablet  <youenn.fablet@crf.canon.fr>
>+
>+        [Fetch API] Add support for fetch mode, in particular cors
>+        https://bugs.webkit.org/show_bug.cgi?id=156753
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Importing CORS tests.
>+        Rebasing some test expectations.
>+        Some tests are timing out because DRT/WTR block access to some URLs.
>+
>+        * resources/ImportExpectations:
>+        * web-platform-tests/fetch/api/basic/integrity-expected.txt:
>+        * web-platform-tests/fetch/api/basic/integrity-worker-expected.txt:
>+        * web-platform-tests/fetch/api/basic/mode-no-cors-expected.txt:
>+        * web-platform-tests/fetch/api/basic/mode-no-cors-worker-expected.txt:
>+        * web-platform-tests/fetch/api/cors/cors-basic-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-basic-worker-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-basic-worker.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-basic.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-basic.js: Added.
>+        (cors):
>+        * web-platform-tests/fetch/api/cors/cors-cookies-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-cookies-worker-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-cookies-worker.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-cookies.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-cookies.js: Added.
>+        (corsCookies):
>+        * web-platform-tests/fetch/api/cors/cors-filtering-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-filtering-worker-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-filtering-worker.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-filtering.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-filtering.js: Added.
>+        (corsFilter):
>+        (corsExposeFilter):
>+        * web-platform-tests/fetch/api/cors/cors-multiple-origins-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-multiple-origins-worker-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-multiple-origins-worker.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-multiple-origins.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-multiple-origins.js: Added.
>+        (corsMultipleOrigins):
>+        * web-platform-tests/fetch/api/cors/cors-no-preflight-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-no-preflight-worker-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-no-preflight-worker.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-no-preflight.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-no-preflight.js: Added.
>+        (corsNoPreflight):
>+        * web-platform-tests/fetch/api/cors/cors-origin-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-origin-worker-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-origin-worker.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-origin.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-origin.js: Added.
>+        (corsOrigin):
>+        * web-platform-tests/fetch/api/cors/cors-preflight-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight-redirect-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight-redirect-worker-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight-redirect-worker.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight-redirect.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight-redirect.js: Added.
>+        (corsPreflightRedirect):
>+        * web-platform-tests/fetch/api/cors/cors-preflight-referrer-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight-referrer-worker-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight-referrer-worker.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight-referrer.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight-referrer.js: Added.
>+        (corsPreflightReferrer):
>+        * web-platform-tests/fetch/api/cors/cors-preflight-status-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight-status-worker-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight-status-worker.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight-status.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight-status.js: Added.
>+        (corsPreflightStatus):
>+        * web-platform-tests/fetch/api/cors/cors-preflight-worker-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight-worker.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-preflight.js: Added.
>+        (corsPreflight):
>+        * web-platform-tests/fetch/api/cors/cors-redirect-credentials-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-redirect-credentials-worker-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-redirect-credentials-worker.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-redirect-credentials.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-redirect-credentials.js: Added.
>+        (corsRedirectCredentials):
>+        * web-platform-tests/fetch/api/cors/cors-redirect-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-redirect-worker-expected.txt: Added.
>+        * web-platform-tests/fetch/api/cors/cors-redirect-worker.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-redirect.html: Added.
>+        * web-platform-tests/fetch/api/cors/cors-redirect.js: Added.
>+        (corsRedirect):
>+        * web-platform-tests/fetch/api/cors/w3c-import.log: Added.
>+
> 2016-04-17  Youenn Fablet  <youenn.fablet@crf.canon.fr>
> 
>         [Fetch API] Consume HTTP data as a ReadableStream
>diff --git a/LayoutTests/imported/w3c/resources/ImportExpectations b/LayoutTests/imported/w3c/resources/ImportExpectations
>index bd2a6d35b3908301ea91740951e34638fd3e03e3..f34f43ceb8a8f96962da3a7bbaf13fdcb8bcb5a0 100644
>--- a/LayoutTests/imported/w3c/resources/ImportExpectations
>+++ b/LayoutTests/imported/w3c/resources/ImportExpectations
>@@ -120,7 +120,6 @@ web-platform-tests/encoding [ Skip ]
> web-platform-tests/eventsource [ Skip ]
> web-platform-tests/ext-xhtml-pubid [ Skip ]
> #web-platform-tests/fetch [ Import ]
>-web-platform-tests/fetch/api/cors [ Skip ]
> web-platform-tests/fetch/api/credentials [ Skip ]
> web-platform-tests/fetch/api/policies [ Skip ]
> web-platform-tests/fetch/api/redirect [ Skip ]
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/integrity-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/integrity-expected.txt
>index c2dadd1f09b38804c1ccca459800b494cdc5b3db..9e73a43c7cc234317f245dc48ce662739caa5c49 100644
>--- a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/integrity-expected.txt
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/integrity-expected.txt
>@@ -1,3 +1,6 @@
>+Blocked access to external URL http://www1.localhost:8800/fetch/api/resources/top.txt?pipe=header(Access-Control-Allow-Origin,*)
>+
>+Harness Error (TIMEOUT), message = null
> 
> PASS Empty string integrity 
> PASS SHA-256 integrity 
>@@ -9,7 +12,7 @@ FAIL Multiple integrities: invalid stronger than valid assert_unreached: Should
> PASS Multiple integrities: invalid as strong as valid 
> PASS Multiple integrities: both are valid 
> FAIL Multiple integrities: both are invalid assert_unreached: Should have rejected. Reached unreachable code
>-FAIL CORS empty integrity promise_test: Unhandled rejection with value: object "TypeError: Type error"
>-FAIL CORS SHA-512 integrity promise_test: Unhandled rejection with value: object "TypeError: Type error"
>-PASS CORS invalid integrity 
>+TIMEOUT CORS empty integrity Test timed out
>+TIMEOUT CORS SHA-512 integrity Test timed out
>+TIMEOUT CORS invalid integrity Test timed out
> 
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/integrity-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/integrity-worker-expected.txt
>index c2dadd1f09b38804c1ccca459800b494cdc5b3db..9e73a43c7cc234317f245dc48ce662739caa5c49 100644
>--- a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/integrity-worker-expected.txt
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/integrity-worker-expected.txt
>@@ -1,3 +1,6 @@
>+Blocked access to external URL http://www1.localhost:8800/fetch/api/resources/top.txt?pipe=header(Access-Control-Allow-Origin,*)
>+
>+Harness Error (TIMEOUT), message = null
> 
> PASS Empty string integrity 
> PASS SHA-256 integrity 
>@@ -9,7 +12,7 @@ FAIL Multiple integrities: invalid stronger than valid assert_unreached: Should
> PASS Multiple integrities: invalid as strong as valid 
> PASS Multiple integrities: both are valid 
> FAIL Multiple integrities: both are invalid assert_unreached: Should have rejected. Reached unreachable code
>-FAIL CORS empty integrity promise_test: Unhandled rejection with value: object "TypeError: Type error"
>-FAIL CORS SHA-512 integrity promise_test: Unhandled rejection with value: object "TypeError: Type error"
>-PASS CORS invalid integrity 
>+TIMEOUT CORS empty integrity Test timed out
>+TIMEOUT CORS SHA-512 integrity Test timed out
>+TIMEOUT CORS invalid integrity Test timed out
> 
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/mode-no-cors-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/mode-no-cors-expected.txt
>index 47cbea743e88722c6d7076874f7945bb7dda27b2..a11249e92998b6718b57ceb38e114679c709d742 100644
>--- a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/mode-no-cors-expected.txt
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/mode-no-cors-expected.txt
>@@ -1,6 +1,9 @@
>+Blocked access to external URL http://www.localhost:8800/fetch/api/resources/top.txt?pipe=header(x-is-filtered,value)
>+
>+Harness Error (TIMEOUT), message = null
> 
> PASS Fetch ../resources/top.txt with no-cors mode 
> PASS Fetch http://localhost:8800/fetch/api/resources/top.txt with no-cors mode 
> FAIL Fetch https://localhost:9443/fetch/api/resources/top.txt with no-cors mode promise_test: Unhandled rejection with value: object "TypeError: Type error"
>-FAIL Fetch http://www.localhost:8800/fetch/api/resources/top.txt with no-cors mode promise_test: Unhandled rejection with value: object "TypeError: Type error"
>+TIMEOUT Fetch http://www.localhost:8800/fetch/api/resources/top.txt with no-cors mode Test timed out
> 
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/mode-no-cors-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/mode-no-cors-worker-expected.txt
>index 47cbea743e88722c6d7076874f7945bb7dda27b2..a11249e92998b6718b57ceb38e114679c709d742 100644
>--- a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/mode-no-cors-worker-expected.txt
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/mode-no-cors-worker-expected.txt
>@@ -1,6 +1,9 @@
>+Blocked access to external URL http://www.localhost:8800/fetch/api/resources/top.txt?pipe=header(x-is-filtered,value)
>+
>+Harness Error (TIMEOUT), message = null
> 
> PASS Fetch ../resources/top.txt with no-cors mode 
> PASS Fetch http://localhost:8800/fetch/api/resources/top.txt with no-cors mode 
> FAIL Fetch https://localhost:9443/fetch/api/resources/top.txt with no-cors mode promise_test: Unhandled rejection with value: object "TypeError: Type error"
>-FAIL Fetch http://www.localhost:8800/fetch/api/resources/top.txt with no-cors mode promise_test: Unhandled rejection with value: object "TypeError: Type error"
>+TIMEOUT Fetch http://www.localhost:8800/fetch/api/resources/top.txt with no-cors mode Test timed out
> 
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..96b71533cd731f5f99a7c789a542d353916026ec
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic-expected.txt
>@@ -0,0 +1,20 @@
>+Blocked access to external URL http://www1.localhost:8800/fetch/api/resources/top.txt?pipe=header(Access-Control-Allow-Origin,*)
>+
>+Harness Error (TIMEOUT), message = null
>+
>+TIMEOUT Cross domain basic usage [no-cors mode] Test timed out
>+TIMEOUT Cross domain basic usage [server forbid CORS] Test timed out
>+TIMEOUT Cross domain basic usage [cors mode] Test timed out
>+TIMEOUT Same domain different port [no-cors mode] Test timed out
>+TIMEOUT Same domain different port [server forbid CORS] Test timed out
>+TIMEOUT Same domain different port [cors mode] Test timed out
>+TIMEOUT Cross domain different port [no-cors mode] Test timed out
>+TIMEOUT Cross domain different port [server forbid CORS] Test timed out
>+TIMEOUT Cross domain different port [cors mode] Test timed out
>+TIMEOUT Cross domain different protocol [no-cors mode] Test timed out
>+TIMEOUT Cross domain different protocol [server forbid CORS] Test timed out
>+TIMEOUT Cross domain different protocol [cors mode] Test timed out
>+TIMEOUT Same domain different protocol different port [no-cors mode] Test timed out
>+TIMEOUT Same domain different protocol different port [server forbid CORS] Test timed out
>+TIMEOUT Same domain different protocol different port [cors mode] Test timed out
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic-worker-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..96b71533cd731f5f99a7c789a542d353916026ec
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic-worker-expected.txt
>@@ -0,0 +1,20 @@
>+Blocked access to external URL http://www1.localhost:8800/fetch/api/resources/top.txt?pipe=header(Access-Control-Allow-Origin,*)
>+
>+Harness Error (TIMEOUT), message = null
>+
>+TIMEOUT Cross domain basic usage [no-cors mode] Test timed out
>+TIMEOUT Cross domain basic usage [server forbid CORS] Test timed out
>+TIMEOUT Cross domain basic usage [cors mode] Test timed out
>+TIMEOUT Same domain different port [no-cors mode] Test timed out
>+TIMEOUT Same domain different port [server forbid CORS] Test timed out
>+TIMEOUT Same domain different port [cors mode] Test timed out
>+TIMEOUT Cross domain different port [no-cors mode] Test timed out
>+TIMEOUT Cross domain different port [server forbid CORS] Test timed out
>+TIMEOUT Cross domain different port [cors mode] Test timed out
>+TIMEOUT Cross domain different protocol [no-cors mode] Test timed out
>+TIMEOUT Cross domain different protocol [server forbid CORS] Test timed out
>+TIMEOUT Cross domain different protocol [cors mode] Test timed out
>+TIMEOUT Same domain different protocol different port [no-cors mode] Test timed out
>+TIMEOUT Same domain different protocol different port [server forbid CORS] Test timed out
>+TIMEOUT Same domain different protocol different port [cors mode] Test timed out
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic-worker.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic-worker.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..97e173c15226f7b73125417d81119865a8deda64
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic-worker.html
>@@ -0,0 +1,19 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch in worker: basic CORS</title>
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-cors-protocol">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#concept-filtered-response-cors">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#concept-cors-check">
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script>
>+      fetch_tests_from_worker(new Worker("cors-basic.js?pipe=sub"));
>+    </script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..4aa38f75b85b7ea7f79ce1df362fafd15d96dc57
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic.html
>@@ -0,0 +1,18 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch:  basic CORS</title>
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-cors-protocol">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#concept-filtered-response-cors">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#concept-cors-check">
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script src="../resources/utils.js"></script>
>+    <script src="cors-basic.js?pipe=sub"></script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic.js b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..3fe4644db14f20099154068f43166d910f37c8b8
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic.js
>@@ -0,0 +1,45 @@
>+if (this.document === undefined) {
>+  importScripts("/resources/testharness.js");
>+  importScripts("../resources/utils.js");
>+}
>+
>+function cors(desc, scheme, subdomain, port) {
>+  if (!port)
>+    port = location.port;
>+  if (subdomain)
>+    subdomain = subdomain + ".";
>+  else
>+    subdomain = "";
>+
>+  var url = scheme + "://" + subdomain + "{{host}}" + ":" + port + dirname(location.pathname);
>+  var urlParameters = "?pipe=header(Access-Control-Allow-Origin,*)";
>+
>+  promise_test(function(test) {
>+    return fetch(url + RESOURCES_DIR + "top.txt" + urlParameters, {"mode": "no-cors"} ).then(function(resp) {
>+      assert_equals(resp.status, 0, "Opaque filter: status is 0");
>+      assert_equals(resp.statusText, "", "Opaque filter: statusText is \"\"");
>+      assert_equals(resp.type , "opaque", "Opaque filter: response's type is opaque");
>+    });
>+  }, desc + " [no-cors mode]");
>+
>+  promise_test(function(test) {
>+    var testedPromise = fetch(url + RESOURCES_DIR + "top.txt", {"mode": "cors"} ).then(function(resp) {
>+      return promise_rejects(test, new TypeError(), testedPromise);
>+    });
>+  }, desc + " [server forbid CORS]");
>+
>+  promise_test(function(test) {
>+    return fetch(url + RESOURCES_DIR + "top.txt" + urlParameters, {"mode": "cors"} ).then(function(resp) {
>+      assert_equals(resp.status, 200, "Fetch's response's status is 200");
>+      assert_equals(resp.type , "cors", "CORS response's type is cors");
>+    });
>+  }, desc + " [cors mode]");
>+}
>+
>+cors("Cross domain basic usage", "http", "www1");
>+cors("Same domain different port", "http", undefined, "{{ports[http][1]}}");
>+cors("Cross domain different port", "http", "www1", "{{ports[http][1]}}");
>+cors("Cross domain different protocol", "https", "www1", "{{ports[https][0]}}");
>+cors("Same domain different protocol different port", "https", undefined, "{{ports[https][0]}}");
>+
>+done();
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..e99ea29b0073ca48cfb14cc5d5b02906959925da
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies-expected.txt
>@@ -0,0 +1,11 @@
>+Blocked access to external URL http://www.localhost:8800/fetch/api/resources/top.txt?pipe=header(Access-Control-Allow-Origin,http://localhost:8800)|header(Access-Control-Allow-Credentials,true)|header(Set-Cookie,a=1,True)
>+
>+Harness Error (TIMEOUT), message = null
>+
>+TIMEOUT Include mode: 1 cookie Test timed out
>+TIMEOUT Include mode: local cookies are not sent with remote request Test timed out
>+TIMEOUT Include mode: remote cookies are not sent with local request Test timed out
>+TIMEOUT Include mode: remote cookies are not sent with other remote request Test timed out
>+TIMEOUT Same-origin mode: cookies are discarded in cors request Test timed out
>+TIMEOUT Omit mode: no cookie sent Test timed out
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies-worker-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..e99ea29b0073ca48cfb14cc5d5b02906959925da
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies-worker-expected.txt
>@@ -0,0 +1,11 @@
>+Blocked access to external URL http://www.localhost:8800/fetch/api/resources/top.txt?pipe=header(Access-Control-Allow-Origin,http://localhost:8800)|header(Access-Control-Allow-Credentials,true)|header(Set-Cookie,a=1,True)
>+
>+Harness Error (TIMEOUT), message = null
>+
>+TIMEOUT Include mode: 1 cookie Test timed out
>+TIMEOUT Include mode: local cookies are not sent with remote request Test timed out
>+TIMEOUT Include mode: remote cookies are not sent with local request Test timed out
>+TIMEOUT Include mode: remote cookies are not sent with other remote request Test timed out
>+TIMEOUT Same-origin mode: cookies are discarded in cors request Test timed out
>+TIMEOUT Omit mode: no cookie sent Test timed out
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies-worker.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies-worker.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..fd79aad8f056abebb886fb019102ec37738fe400
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies-worker.html
>@@ -0,0 +1,18 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch in worker: cookies management for cors requests</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-network-fetch">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script>
>+      fetch_tests_from_worker(new Worker("cors-cookies.js?pipe=sub"));
>+    </script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..8fb6a7c0cd7d49243b0eb79c3e669837b41d4bf9
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies.html
>@@ -0,0 +1,17 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch: cookies management for cors requests</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-network-fetch">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script src="../resources/utils.js"></script>
>+    <script src="cors-cookies.js?pipe=sub"></script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies.js b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..d79dc84860df45cc1d3b8f21449eb3e88b1e6e2f
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies.js
>@@ -0,0 +1,58 @@
>+if (this.document === undefined) {
>+  importScripts("/resources/testharness.js");
>+  importScripts("../resources/utils.js");
>+}
>+
>+function corsCookies(desc, domain1, domain2, credentialsMode, cookies) {
>+  var urlSetCookie = "http://" + domain1 + ":{{ports[http][0]}}" + dirname(location.pathname) + RESOURCES_DIR + "top.txt";
>+  var urlCheckCookies = "http://" + domain2 + ":{{ports[http][0]}}" + dirname(location.pathname) + RESOURCES_DIR + "inspect-headers.py?cors&headers=cookie";
>+  //enable cors with credentials
>+  var urlParameters = "?pipe=header(Access-Control-Allow-Origin," + location.origin + ")";
>+  urlParameters += "|header(Access-Control-Allow-Credentials,true)";
>+
>+  var urlCleanParameters = "?pipe=header(Access-Control-Allow-Origin," + location.origin + ")";
>+  urlCleanParameters += "|header(Access-Control-Allow-Credentials,true)";
>+  if (cookies) {
>+    urlParameters += "|header(Set-Cookie,";
>+    urlParameters += cookies.join(",True)|header(Set-Cookie,") +  ",True)";
>+    urlCleanParameters += "|header(Set-Cookie,";
>+    urlCleanParameters +=  cookies.join("%3B%20max-age=0,True)|header(Set-Cookie,") +  "%3B%20max-age=0,True)";
>+  }
>+
>+  var requestInit = {"credentials": credentialsMode, "mode": "cors"};
>+
>+  promise_test(function(test){
>+    return fetch(urlSetCookie + urlParameters, requestInit).then(function(resp) {
>+      assert_equals(resp.status, 200, "HTTP status is 200");
>+      //check cookies sent
>+      return fetch(urlCheckCookies, requestInit);
>+    }).then(function(resp) {
>+      assert_equals(resp.status, 200, "HTTP status is 200");
>+      assert_false(resp.headers.has("Cookie") , "Cookie header is not exposed in response");
>+      if (credentialsMode === "include" && domain1 === domain2) {
>+        assert_equals(resp.headers.get("x-request-cookie") , cookies.join("; "), "Request includes cookie(s)");
>+      }
>+      else {
>+        assert_false(resp.headers.has("x-request-cookie") , "Request should have no cookie");
>+      }
>+      //clean cookies
>+      return fetch(urlSetCookie + urlCleanParameters, {"credentials": "include"});
>+    }).catch(function(e) {
>+      fetch(urlSetCookie + urlCleanParameters, {"credentials": "include"});
>+      throw e;
>+    });
>+  }, desc);
>+}
>+
>+var local = "{{host}}";
>+var remote = "www.{{host}}";
>+var remote1 = "www1.{{host}}";
>+
>+corsCookies("Include mode: 1 cookie", remote, remote, "include", ["a=1"]);
>+corsCookies("Include mode: local cookies are not sent with remote request", local, remote, "include", ["c=3"]);
>+corsCookies("Include mode: remote cookies are not sent with local request", remote, local, "include", ["d=4"]);
>+corsCookies("Include mode: remote cookies are not sent with other remote request", remote, remote1, "include", ["e=5"]);
>+corsCookies("Same-origin mode: cookies are discarded in cors request", remote, remote, "same-origin", ["f=6"]);
>+corsCookies("Omit mode: no cookie sent", local, local, "omit", ["g=7"]);
>+
>+done();
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..9a424e8844ca2ad4ae6cfa7c35339955d9e5342b
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering-expected.txt
>@@ -0,0 +1,23 @@
>+Blocked access to external URL http://www1.localhost:8801/fetch/api/resources/top.txt?pipe=header(Cache-Control,no-cache)|header(Access-Control-Allow-Origin,*)
>+
>+Harness Error (TIMEOUT), message = null
>+
>+TIMEOUT CORS filter on Cache-Control header Test timed out
>+TIMEOUT CORS filter on Content-Language header Test timed out
>+TIMEOUT CORS filter on Content-Type header Test timed out
>+TIMEOUT CORS filter on Expires header Test timed out
>+TIMEOUT CORS filter on Last-Modified header Test timed out
>+TIMEOUT CORS filter on Pragma header Test timed out
>+TIMEOUT CORS filter on Age header Test timed out
>+TIMEOUT CORS filter on Server header Test timed out
>+TIMEOUT CORS filter on Warning header Test timed out
>+TIMEOUT CORS filter on Content-Length header Test timed out
>+TIMEOUT CORS filter on Set-Cookie header Test timed out
>+TIMEOUT CORS filter on Set-Cookie2 header Test timed out
>+TIMEOUT CORS filter on Age header, header is exposed Test timed out
>+TIMEOUT CORS filter on Server header, header is exposed Test timed out
>+TIMEOUT CORS filter on Warning header, header is exposed Test timed out
>+TIMEOUT CORS filter on Content-Length header, header is exposed Test timed out
>+TIMEOUT CORS filter on Set-Cookie header, header is exposed Test timed out
>+TIMEOUT CORS filter on Set-Cookie2 header, header is exposed Test timed out
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering-worker-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..9a424e8844ca2ad4ae6cfa7c35339955d9e5342b
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering-worker-expected.txt
>@@ -0,0 +1,23 @@
>+Blocked access to external URL http://www1.localhost:8801/fetch/api/resources/top.txt?pipe=header(Cache-Control,no-cache)|header(Access-Control-Allow-Origin,*)
>+
>+Harness Error (TIMEOUT), message = null
>+
>+TIMEOUT CORS filter on Cache-Control header Test timed out
>+TIMEOUT CORS filter on Content-Language header Test timed out
>+TIMEOUT CORS filter on Content-Type header Test timed out
>+TIMEOUT CORS filter on Expires header Test timed out
>+TIMEOUT CORS filter on Last-Modified header Test timed out
>+TIMEOUT CORS filter on Pragma header Test timed out
>+TIMEOUT CORS filter on Age header Test timed out
>+TIMEOUT CORS filter on Server header Test timed out
>+TIMEOUT CORS filter on Warning header Test timed out
>+TIMEOUT CORS filter on Content-Length header Test timed out
>+TIMEOUT CORS filter on Set-Cookie header Test timed out
>+TIMEOUT CORS filter on Set-Cookie2 header Test timed out
>+TIMEOUT CORS filter on Age header, header is exposed Test timed out
>+TIMEOUT CORS filter on Server header, header is exposed Test timed out
>+TIMEOUT CORS filter on Warning header, header is exposed Test timed out
>+TIMEOUT CORS filter on Content-Length header, header is exposed Test timed out
>+TIMEOUT CORS filter on Set-Cookie header, header is exposed Test timed out
>+TIMEOUT CORS filter on Set-Cookie2 header, header is exposed Test timed out
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering-worker.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering-worker.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..f15566fc509d3b5cea6ecfa27e68b8a89896ef3e
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering-worker.html
>@@ -0,0 +1,18 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch in worker: filtered headers in CORS response</title>
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-cors-protocol">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#concept-filtered-response-cors">
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script>
>+      fetch_tests_from_worker(new Worker("cors-filtering.js?pipe=sub"));
>+    </script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..b7500ad16d441026b5ac98edf10dbc884035df10
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering.html
>@@ -0,0 +1,17 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch: filtered headers in CORS response</title>
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-cors-protocol">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#concept-filtered-response-cors">
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script src="../resources/utils.js"></script>
>+    <script src="cors-filtering.js?pipe=sub"></script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering.js b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..aa21070f394adc211782be5f4b959c49b6bca942
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering.js
>@@ -0,0 +1,66 @@
>+if (this.document === undefined) {
>+  importScripts("/resources/testharness.js");
>+  importScripts("../resources/utils.js");
>+}
>+
>+function corsFilter(corsUrl, headerName, headerValue, isFiltered) {
>+  var url = corsUrl + "?pipe=header(" + headerName + "," + encodeURIComponent(headerValue) +")|header(Access-Control-Allow-Origin,*)";
>+  promise_test(function(test) {
>+    return fetch(url).then(function(resp) {
>+      assert_equals(resp.status, 200, "Fetch success with code 200");
>+      assert_equals(resp.type , "cors", "CORS fetch's response has cors type");
>+      if (!isFiltered) {
>+        assert_equals(resp.headers.get(headerName), headerValue,
>+          headerName + " header should be included in response with value: " + headerValue);
>+      } else {
>+        assert_false(resp.headers.has(headerName), "UA should exclude " + headerName + " header from response");
>+      }
>+      test.done();
>+    });
>+  }, "CORS filter on " + headerName + " header");
>+}
>+
>+function corsExposeFilter(corsUrl, headerName, headerValue, isForbidden) {
>+  var url = corsUrl + "?pipe=header(" + headerName + "," + encodeURIComponent(headerValue) +")|" +
>+                            "header(Access-Control-Allow-Origin,*)" +
>+                            "header(Access-Control-Expose-Headers," + headerName + ")";
>+
>+  promise_test(function(test) {
>+    return fetch(url).then(function(resp) {
>+      assert_equals(resp.status, 200, "Fetch success with code 200");
>+      assert_equals(resp.type , "cors", "CORS fetch's response has cors type");
>+      if (!isForbidden) {
>+        assert_equals(resp.headers.get(headerName), headerValue,
>+          headerName + " header should be included in response with value: " + headerValue);
>+      } else {
>+        assert_false(resp.headers.has(headerName), "UA should exclude " + headerName + " header from response");
>+      }
>+      test.done();
>+    });
>+  }, "CORS filter on " + headerName + " header, header is exposed");
>+}
>+
>+var url = "http://www1.{{host}}:{{ports[http][1]}}" + dirname(location.pathname) + RESOURCES_DIR + "top.txt";
>+
>+corsFilter(url, "Cache-Control", "no-cache", false);
>+corsFilter(url, "Content-Language", "fr", false);
>+corsFilter(url, "Content-Type", "text/html", false);
>+corsFilter(url, "Expires","04 May 1988 22:22:22 GMT" , false);
>+corsFilter(url, "Last-Modified", "04 May 1988 22:22:22 GMT", false);
>+corsFilter(url, "Pragma", "no-cache", false);
>+
>+corsFilter(url, "Age", "27", true);
>+corsFilter(url, "Server", "wptServe" , true);
>+corsFilter(url, "Warning", "Mind the gap" , true);
>+corsFilter(url, "Content-Length", "0" , true);
>+corsFilter(url, "Set-Cookie", "name=value" , true);
>+corsFilter(url, "Set-Cookie2", "name=value" , true);
>+
>+corsExposeFilter(url, "Age", "27", false);
>+corsExposeFilter(url, "Server", "wptServe" , false);
>+corsExposeFilter(url, "Warning", "Mind the gap" , false);
>+corsExposeFilter(url, "Content-Length", "0" , false);
>+corsExposeFilter(url, "Set-Cookie", "name=value" , true);
>+corsExposeFilter(url, "Set-Cookie2", "name=value" , true);
>+
>+done();
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..886052723910a498c296b46aa301854c8a7dc268
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins-expected.txt
>@@ -0,0 +1,11 @@
>+Blocked access to external URL http://www1.localhost:8800/fetch/api/resources/preflight.py?origin=%22%22%2C%20http%3A%2F%2Fexample.com%2C%20http%3A%2F%2Flocalhost%3A8800
>+
>+Harness Error (TIMEOUT), message = null
>+
>+TIMEOUT 3 origins allowed, match the 3rd (http://localhost:8800) Test timed out
>+TIMEOUT 3 origins allowed, match the 3rd ("*") Test timed out
>+TIMEOUT 3 origins allowed, match twice (http://localhost:8800) Test timed out
>+TIMEOUT 3 origins allowed, match twice ("*") Test timed out
>+TIMEOUT 3 origins allowed, match twice ("*" and http://localhost:8800) Test timed out
>+TIMEOUT 3 origins allowed, no match Test timed out
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins-worker-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..886052723910a498c296b46aa301854c8a7dc268
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins-worker-expected.txt
>@@ -0,0 +1,11 @@
>+Blocked access to external URL http://www1.localhost:8800/fetch/api/resources/preflight.py?origin=%22%22%2C%20http%3A%2F%2Fexample.com%2C%20http%3A%2F%2Flocalhost%3A8800
>+
>+Harness Error (TIMEOUT), message = null
>+
>+TIMEOUT 3 origins allowed, match the 3rd (http://localhost:8800) Test timed out
>+TIMEOUT 3 origins allowed, match the 3rd ("*") Test timed out
>+TIMEOUT 3 origins allowed, match twice (http://localhost:8800) Test timed out
>+TIMEOUT 3 origins allowed, match twice ("*") Test timed out
>+TIMEOUT 3 origins allowed, match twice ("*" and http://localhost:8800) Test timed out
>+TIMEOUT 3 origins allowed, no match Test timed out
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins-worker.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins-worker.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..a8e50573278d2e911cfda6c9608b8fe6f189ed85
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins-worker.html
>@@ -0,0 +1,19 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch in worker: check multiple Access-Control-Allow-Origin header management</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-cors-protocol">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#cors-check">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script>
>+      fetch_tests_from_worker(new Worker("cors-multiple-origins.js?pipe=sub"));
>+    </script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..9b12b05064b0f17e9f37ffd001470f6c258b1b95
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins.html
>@@ -0,0 +1,18 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch: check multiple Access-Control-Allow-Origin header management</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-cors-protocol">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#cors-check">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script src="../resources/utils.js"></script>
>+    <script src="cors-multiple-origins.js?pipe=sub"></script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins.js b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..35c404b7770303ee4386e3cf74518ca7fe4e11b3
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins.js
>@@ -0,0 +1,32 @@
>+if (this.document === undefined) {
>+  importScripts("/resources/testharness.js");
>+  importScripts("../resources/utils.js");
>+}
>+
>+function corsMultipleOrigins(desc, originList, shouldPass) {
>+  var urlParameters = "?origin=" + encodeURIComponent(originList.join(", "));
>+  var url = "http://www1.{{host}}:{{ports[http][0]}}" + dirname(location.pathname) + RESOURCES_DIR + "preflight.py";
>+
>+  if (shouldPass) {
>+    promise_test(function(test) {
>+      return fetch(url + urlParameters).then(function(resp) {
>+        assert_equals(resp.status, 200, "Response's status is 200");
>+      });
>+    }, desc);
>+  } else {
>+    promise_test(function(test) {
>+      return promise_rejects(test, new TypeError(), fetch(url + urlParameters));
>+    }, desc);
>+  }
>+}
>+/* Actual origin */
>+var origin = "http://{{host}}:{{ports[http][0]}}";
>+
>+corsMultipleOrigins("3 origins allowed, match the 3rd (" + origin + ")", ["\"\"", "http://example.com", origin], true);
>+corsMultipleOrigins("3 origins allowed, match the 3rd (\"*\")", ["\"\"", "http://example.com", "*"], true);
>+corsMultipleOrigins("3 origins allowed, match twice (" + origin + ")", ["\"\"", origin, origin], true);
>+corsMultipleOrigins("3 origins allowed, match twice (\"*\")", ["*", "http://example.com", "*"], true);
>+corsMultipleOrigins("3 origins allowed, match twice (\"*\" and " + origin + ")", ["*", "http://example.com", origin], true);
>+corsMultipleOrigins("3 origins allowed, no match", ["", "http://example.com", "https://example2.com"], false);
>+
>+done();
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..b62c6899436d11074f5bcfdd2c85677daa0b9b9d
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-expected.txt
>@@ -0,0 +1,16 @@
>+
>+PASS Cross domain basic usage [GET] 
>+PASS Same domain different port [GET] 
>+PASS Cross domain different port [GET] 
>+PASS Cross domain different protocol [GET] 
>+PASS Same domain different protocol different port [GET] 
>+PASS Cross domain [POST] 
>+PASS Cross domain [HEAD] 
>+PASS Cross domain [GET] [Accept: */*] 
>+PASS Cross domain [GET] [Accept-Language: fr] 
>+PASS Cross domain [GET] [Content-Language: fr] 
>+PASS Cross domain [GET] [Content-Type: application/x-www-form-urlencoded] 
>+PASS Cross domain [GET] [Content-Type: multipart/form-data] 
>+PASS Cross domain [GET] [Content-Type: text/plain] 
>+PASS Cross domain [GET] [Content-Type: text/plain;charset=utf-8] 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-worker-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..b62c6899436d11074f5bcfdd2c85677daa0b9b9d
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-worker-expected.txt
>@@ -0,0 +1,16 @@
>+
>+PASS Cross domain basic usage [GET] 
>+PASS Same domain different port [GET] 
>+PASS Cross domain different port [GET] 
>+PASS Cross domain different protocol [GET] 
>+PASS Same domain different protocol different port [GET] 
>+PASS Cross domain [POST] 
>+PASS Cross domain [HEAD] 
>+PASS Cross domain [GET] [Accept: */*] 
>+PASS Cross domain [GET] [Accept-Language: fr] 
>+PASS Cross domain [GET] [Content-Language: fr] 
>+PASS Cross domain [GET] [Content-Type: application/x-www-form-urlencoded] 
>+PASS Cross domain [GET] [Content-Type: multipart/form-data] 
>+PASS Cross domain [GET] [Content-Type: text/plain] 
>+PASS Cross domain [GET] [Content-Type: text/plain;charset=utf-8] 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-worker.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-worker.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..c6402ada09318b30a4d0e590f3c4d7fd0f5b10fd
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-worker.html
>@@ -0,0 +1,20 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch in worker: CORS request with simple methods and headers</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-cors-protocol">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#simple-method">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#simple-header">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script>
>+      fetch_tests_from_worker(new Worker("cors-no-preflight.js?pipe=sub"));
>+    </script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..3ff5c97eac697fe2a3b785c315cf43d826f03022
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight.html
>@@ -0,0 +1,20 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch: CORS request with simple methods and headers</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-cors-protocol">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#simple-method">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#simple-header">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script src="/common/utils.js"></script>
>+    <script src="../resources/utils.js"></script>
>+    <script src="cors-no-preflight.js?pipe=sub"></script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight.js b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..8d932cc38bc716d32be04d32089aa10e78bf3bf7
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight.js
>@@ -0,0 +1,50 @@
>+if (this.document === undefined) {
>+  importScripts("/resources/testharness.js");
>+  importScripts("/common/utils.js");
>+  importScripts("../resources/utils.js");
>+}
>+
>+function corsNoPreflight(desc, scheme, subdomain, port, method, headerName, headerValue) {
>+  if (!port)
>+    port = location.port;
>+  if (subdomain)
>+    subdomain = subdomain + ".";
>+  else
>+    subdomain = "";
>+
>+  var uuid_token = token();
>+  var url = scheme + "://" + subdomain + "{{host}}" + ":" + port + dirname(location.pathname) + RESOURCES_DIR + "preflight.py";
>+  var urlParameters = "?token=" + uuid_token + "&max_age=0";
>+  var requestInit = {"mode": "cors", "method": method, "headers":{}};
>+  if (headerName)
>+    requestInit["headers"][headerName] = headerValue;
>+
>+  promise_test(function(test) {
>+    fetch(RESOURCES_DIR + "clean-stash.py?token=" + uuid_token).then(function(resp) {
>+      assert_equals(resp.status, 200, "Clean stash response's status is 200");
>+      return fetch(url + urlParameters, requestInit).then(function(resp) {
>+        assert_equals(resp.status, 200, "Response's status is 200");
>+        assert_equals(resp.headers.get("x-did-preflight"), "0", "No preflight request has been made");
>+      });
>+    });
>+  }, desc);
>+}
>+var port2 = "{{ports[http][1]}}";
>+var httpsPort = "{{ports[https][0]}}";
>+
>+corsNoPreflight("Cross domain basic usage [GET]", "http", "www1", undefined, "GET");
>+corsNoPreflight("Same domain different port [GET]", "http", undefined, port2, "GET");
>+corsNoPreflight("Cross domain different port [GET]", "http", "www1", port2, "GET");
>+corsNoPreflight("Cross domain different protocol [GET]", "https", "www1", httpsPort, "GET");
>+corsNoPreflight("Same domain different protocol different port [GET]", "https", undefined, httpsPort, "GET");
>+corsNoPreflight("Cross domain [POST]", "http", "www1", undefined, "POST");
>+corsNoPreflight("Cross domain [HEAD]", "http", "www1", undefined, "HEAD");
>+corsNoPreflight("Cross domain [GET] [Accept: */*]", "http", "www1", undefined, "GET" , "Accept", "*/*");
>+corsNoPreflight("Cross domain [GET] [Accept-Language: fr]", "http", "www1", undefined, "GET" , "Accept-Language", "fr");
>+corsNoPreflight("Cross domain [GET] [Content-Language: fr]", "http", "www1", undefined, "GET" , "Content-Language", "fr");
>+corsNoPreflight("Cross domain [GET] [Content-Type: application/x-www-form-urlencoded]", "http", "www1", undefined, "GET" , "Content-Type", "application/x-www-form-urlencoded");
>+corsNoPreflight("Cross domain [GET] [Content-Type: multipart/form-data]", "http", "www1", undefined, "GET" , "Content-Type", "multipart/form-data");
>+corsNoPreflight("Cross domain [GET] [Content-Type: text/plain]", "http", "www1", undefined, "GET" , "Content-Type", "text/plain");
>+corsNoPreflight("Cross domain [GET] [Content-Type: text/plain;charset=utf-8]", "http", "www1", undefined, "GET" , "Content-Type", "text/plain;charset=utf-8");
>+
>+done();
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..60f56e5516604198e63a66d66cc749b45bbbfe39
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin-expected.txt
>@@ -0,0 +1,19 @@
>+
>+PASS Cross domain different subdomain [origin OK] 
>+PASS Cross domain different subdomain [origin KO] 
>+PASS Same domain different port [origin OK] 
>+PASS Same domain different port [origin KO] 
>+PASS Cross domain different port [origin OK] 
>+PASS Cross domain different port [origin KO] 
>+PASS Cross domain different protocol [origin OK] 
>+PASS Cross domain different protocol [origin KO] 
>+PASS Same domain different protocol different port [origin OK] 
>+PASS Same domain different protocol different port [origin KO] 
>+PASS Cross domain [POST] [origin OK] 
>+PASS Cross domain [POST] [origin KO] 
>+PASS Cross domain [HEAD] [origin OK] 
>+PASS Cross domain [HEAD] [origin KO] 
>+PASS CORS preflight [PUT] [origin OK] 
>+PASS CORS preflight [PUT] [origin KO] 
>+PASS Allowed origin: "" [origin KO] 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin-worker-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..60f56e5516604198e63a66d66cc749b45bbbfe39
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin-worker-expected.txt
>@@ -0,0 +1,19 @@
>+
>+PASS Cross domain different subdomain [origin OK] 
>+PASS Cross domain different subdomain [origin KO] 
>+PASS Same domain different port [origin OK] 
>+PASS Same domain different port [origin KO] 
>+PASS Cross domain different port [origin OK] 
>+PASS Cross domain different port [origin KO] 
>+PASS Cross domain different protocol [origin OK] 
>+PASS Cross domain different protocol [origin KO] 
>+PASS Same domain different protocol different port [origin OK] 
>+PASS Same domain different protocol different port [origin KO] 
>+PASS Cross domain [POST] [origin OK] 
>+PASS Cross domain [POST] [origin KO] 
>+PASS Cross domain [HEAD] [origin OK] 
>+PASS Cross domain [HEAD] [origin KO] 
>+PASS CORS preflight [PUT] [origin OK] 
>+PASS CORS preflight [PUT] [origin KO] 
>+PASS Allowed origin: "" [origin KO] 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin-worker.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin-worker.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..f6145e6e3e1a3be1f3bb0472a36ee2aefeb15301
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin-worker.html
>@@ -0,0 +1,19 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch in worker: check Access-Control-Allow-Origin header management</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-cors-protocol">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#cors-check">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script>
>+      fetch_tests_from_worker(new Worker("cors-origin.js?pipe=sub"));
>+    </script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..de7a0552accb28aa730eaa496bb649619a2861dd
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin.html
>@@ -0,0 +1,19 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch: check Access-Control-Allow-Origin header management</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-cors-protocol">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#cors-check">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script src="/common/utils.js"></script>
>+    <script src="../resources/utils.js"></script>
>+    <script src="cors-origin.js?pipe=sub"></script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin.js b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..36052742a5fa3431ef0a3682b35d1dc007ed0a10
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin.js
>@@ -0,0 +1,61 @@
>+if (this.document === undefined) {
>+  importScripts("/resources/testharness.js");
>+  importScripts("../resources/utils.js");
>+  importScripts("/common/utils.js");
>+}
>+
>+/* If origin is undefined, it is set to fetched url's origin*/
>+function corsOrigin(desc, scheme, subdomain, port, method, origin, shouldPass) {
>+  if (!port)
>+    port = location.port;
>+  if (subdomain)
>+    subdomain = subdomain + ".";
>+  else
>+    subdomain = "";
>+  if (!origin)
>+    origin = scheme + "://" + subdomain + "{{host}}" + ":" + port;
>+
>+  var uuid_token = token();
>+  var urlParameters = "?token=" + uuid_token + "&max_age=0&origin=" + encodeURIComponent(origin) + "&allow_methods=" + method;
>+  var url = scheme + "://" + subdomain + "{{host}}" + ":" + port + dirname(location.pathname) + RESOURCES_DIR + "preflight.py";
>+  var requestInit = {"mode": "cors", "method": method};
>+
>+  promise_test(function(test) {
>+    fetch(RESOURCES_DIR + "clean-stash.py?token=" + uuid_token).then(function(resp) {
>+      assert_equals(resp.status, 200, "Clean stash response's status is 200");
>+      if (shouldPass) {
>+        return fetch(url + urlParameters, requestInit).then(function(resp) {
>+          assert_equals(resp.status, 200, "Response's status is 200");
>+        });
>+      } else {
>+        return promise_rejects(test, new TypeError(), fetch(url + urlParameters, requestInit));
>+      }
>+    });
>+  }, desc);
>+
>+}
>+var port = "{{ports[http][0]}}";
>+var port2 = "{{ports[http][1]}}";
>+var httpsPort = "{{ports[https][0]}}";
>+/* Actual origin */
>+var origin = "http://{{host}}:{{ports[http][0]}}";
>+
>+corsOrigin("Cross domain different subdomain [origin OK]", "http", "www1", undefined, "GET", origin, true);
>+corsOrigin("Cross domain different subdomain [origin KO]", "http", "www1", undefined, "GET", undefined, false);
>+corsOrigin("Same domain different port [origin OK]", "http", undefined, port2, "GET", origin, true);
>+corsOrigin("Same domain different port [origin KO]", "http", undefined, port2, "GET", undefined, false);
>+corsOrigin("Cross domain different port [origin OK]", "http", "www1", port2, "GET", origin, true);
>+corsOrigin("Cross domain different port [origin KO]", "http", "www1", port2, "GET", undefined, false);
>+corsOrigin("Cross domain different protocol [origin OK]", "https", "www1", httpsPort, "GET", origin, true);
>+corsOrigin("Cross domain different protocol [origin KO]", "https", "www1", httpsPort, "GET", undefined, false);
>+corsOrigin("Same domain different protocol different port [origin OK]", "https", undefined, httpsPort, "GET", origin, true);
>+corsOrigin("Same domain different protocol different port [origin KO]", "https", undefined, httpsPort, "GET", undefined, false);
>+corsOrigin("Cross domain [POST] [origin OK]", "http", "www1", undefined, "POST", origin, true);
>+corsOrigin("Cross domain [POST] [origin KO]", "http", "www1", undefined, "POST", undefined, false);
>+corsOrigin("Cross domain [HEAD] [origin OK]", "http", "www1", undefined, "HEAD", origin, true);
>+corsOrigin("Cross domain [HEAD] [origin KO]", "http", "www1", undefined, "HEAD", undefined, false);
>+corsOrigin("CORS preflight [PUT] [origin OK]", "http", "www1", undefined, "PUT", origin, true);
>+corsOrigin("CORS preflight [PUT] [origin KO]", "http", "www1", undefined, "PUT", undefined, false);
>+corsOrigin("Allowed origin: \"\" [origin KO]", "http", "www1", undefined, "GET", "" , false);
>+
>+done();
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..e12d2f47c614b74c3d10c883c4ab364d4ee3855a
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-expected.txt
>@@ -0,0 +1,3 @@
>+
>+PASS Fetch: Check cors fetches requiring preflight 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..bee76bbc5d79d3450b1dcf93f22040409b793478
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect-expected.txt
>@@ -0,0 +1,12 @@
>+
>+PASS Redirection 301 on preflight failed 
>+PASS Redirection 301 after preflight failed 
>+PASS Redirection 302 on preflight failed 
>+PASS Redirection 302 after preflight failed 
>+PASS Redirection 303 on preflight failed 
>+PASS Redirection 303 after preflight failed 
>+PASS Redirection 307 on preflight failed 
>+PASS Redirection 307 after preflight failed 
>+PASS Redirection 308 on preflight failed 
>+PASS Redirection 308 after preflight failed 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect-worker-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..bee76bbc5d79d3450b1dcf93f22040409b793478
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect-worker-expected.txt
>@@ -0,0 +1,12 @@
>+
>+PASS Redirection 301 on preflight failed 
>+PASS Redirection 301 after preflight failed 
>+PASS Redirection 302 on preflight failed 
>+PASS Redirection 302 after preflight failed 
>+PASS Redirection 303 on preflight failed 
>+PASS Redirection 303 after preflight failed 
>+PASS Redirection 307 on preflight failed 
>+PASS Redirection 307 after preflight failed 
>+PASS Redirection 308 on preflight failed 
>+PASS Redirection 308 after preflight failed 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect-worker.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect-worker.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..663f5d655c133d67b73edaf5cf81f7fc71c58a72
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect-worker.html
>@@ -0,0 +1,18 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch in worker: redirection handling for cors with preflight</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-cors-protocol">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-fetch">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script>
>+      fetch_tests_from_worker(new Worker("cors-preflight-redirect.js?pipe=sub"));
>+    </script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..6f136af76be9bf86a1219a851126d7ee33ca492e
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect.html
>@@ -0,0 +1,18 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch: redirection handling for cors with preflight</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-cors-protocol">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-fetch">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script src="/common/utils.js"></script>
>+    <script src="../resources/utils.js"></script>
>+    <script src="cors-preflight-redirect.js?pipe=sub"></script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect.js b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..52a7bca3cd71335727ade98000ea6e4463911f8c
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect.js
>@@ -0,0 +1,40 @@
>+if (this.document === undefined) {
>+  importScripts("/resources/testharness.js");
>+  importScripts("../resources/utils.js");
>+  importScripts("/common/utils.js");
>+}
>+
>+function corsPreflightRedirect(desc, redirectUrl, redirectLocation, redirectStatus, redirectPreflight) {
>+  var uuid_token = token();
>+  var url = redirectUrl;
>+  var urlParameters = "?token=" + uuid_token + "&max_age=0";
>+  urlParameters += "&redirect_status=" + redirectStatus;
>+  urlParameters += "&location=" + encodeURIComponent(redirectLocation);
>+
>+  if (redirectPreflight)
>+    urlParameters += "&redirect_preflight";
>+  var requestInit = {"mode": "cors", "redirect": "follow"};
>+
>+  /* Force preflight */
>+  requestInit["headers"] = {"x-force-preflight": ""};
>+  urlParameters += "&allow_headers=x-force-preflight";
>+
>+  promise_test(function(test) {
>+    fetch(RESOURCES_DIR + "clean-stash.py?token=" + uuid_token).then(function(resp) {
>+      assert_equals(resp.status, 200, "Clean stash response's status is 200");
>+      return promise_rejects(test, new TypeError(), fetch(url + urlParameters, requestInit));
>+    });
>+  }, desc);
>+}
>+
>+var redirectUrl = "http://www1.{{host}}:{{ports[http][0]}}" + dirname(location.pathname) + RESOURCES_DIR + "redirect.py";
>+var locationUrl = "http://www1.{{host}}:{{ports[http][0]}}" + dirname(location.pathname) + RESOURCES_DIR + "preflight.py";
>+
>+for (var code of [301, 302, 303, 307, 308]) {
>+  /* preflight should not follow the redirection */
>+  corsPreflightRedirect("Redirection " + code + " on preflight failed", redirectUrl, locationUrl, code, true);
>+  /* preflight is done before redirection: preflight force redirect to error */
>+  corsPreflightRedirect("Redirection " + code + " after preflight failed", redirectUrl, locationUrl, code, false);
>+}
>+
>+done();
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..9f08b2f3b948cc5277fa07b93945cf69d98a519a
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer-expected.txt
>@@ -0,0 +1,7 @@
>+
>+PASS Referrer policy: no-referrer 
>+PASS Referrer policy: "" 
>+PASS Referrer policy: origin-only 
>+PASS Referrer policy: origin-when-cross-origin 
>+PASS Referrer policy: unsafe-url 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer-worker-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..9f08b2f3b948cc5277fa07b93945cf69d98a519a
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer-worker-expected.txt
>@@ -0,0 +1,7 @@
>+
>+PASS Referrer policy: no-referrer 
>+PASS Referrer policy: "" 
>+PASS Referrer policy: origin-only 
>+PASS Referrer policy: origin-when-cross-origin 
>+PASS Referrer policy: unsafe-url 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer-worker.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer-worker.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..4ed9072fb5121445a498ab75422183538dcc7155
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer-worker.html
>@@ -0,0 +1,18 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch in worker: Referer header management in CORS request with preflight</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#cors-preflight-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-network-or-cache-fetch">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script>
>+      fetch_tests_from_worker(new Worker("cors-preflight-referrer.js?pipe=sub"));
>+    </script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..a399a051cb1e5289944b742491b0921ce6b79019
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer.html
>@@ -0,0 +1,18 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch: Referer header management in CORS request with preflight</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#cors-preflight-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-network-or-cache-fetch">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script src="/common/utils.js"></script>
>+    <script src="../resources/utils.js"></script>
>+    <script src="cors-preflight-referrer.js?pipe=sub"></script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer.js b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..5cc3a084436daaa91b33fe01bb3d76de56ee12e3
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer.js
>@@ -0,0 +1,39 @@
>+if (this.document === undefined) {
>+  importScripts("/resources/testharness.js");
>+  importScripts("/common/utils.js");
>+  importScripts("../resources/utils.js");
>+}
>+
>+function corsPreflightReferrer(desc, corsUrl, referrerPolicy, expectedReferrer) {
>+  var uuid_token = token();
>+  var url = corsUrl;
>+  var urlParameters = "?token=" + uuid_token + "&max_age=0";
>+  var requestInit = {"mode": "cors", "referrerPolicy": referrerPolicy};
>+
>+  /* Force preflight */
>+  requestInit["headers"] = {"x-force-preflight": ""};
>+  urlParameters += "&allow_headers=x-force-preflight";
>+
>+  promise_test(function(test) {
>+    fetch(RESOURCES_DIR + "clean-stash.py?token=" + uuid_token).then(function(resp) {
>+      assert_equals(resp.status, 200, "Clean stash response's status is 200");
>+      return fetch(url + urlParameters, requestInit).then(function(resp) {
>+        assert_equals(resp.status, 200, "Response's status is 200");
>+        assert_equals(resp.headers.get("x-did-preflight"), "1", "Preflight request has been made");
>+        assert_equals(resp.headers.get("x-preflight-referrer"), expectedReferrer, "Preflight's referrer is correct");
>+        assert_equals(resp.headers.get("x-referrer"), expectedReferrer, "Request's refferer is correct");
>+      });
>+    });
>+  }, desc);
>+}
>+
>+var corsUrl = "http://www1.{{host}}:{{ports[http][0]}}" + dirname(location.pathname) + RESOURCES_DIR + "preflight.py";
>+var origin = "http://{{host}}:{{ports[http][0]}}";
>+
>+corsPreflightReferrer("Referrer policy: no-referrer", corsUrl, "no-referrer", "");
>+corsPreflightReferrer("Referrer policy: \"\"", corsUrl, "", "");
>+corsPreflightReferrer("Referrer policy: origin-only", corsUrl, "origin-only", origin);
>+corsPreflightReferrer("Referrer policy: origin-when-cross-origin", corsUrl, "origin-when-cross-origin", origin);
>+corsPreflightReferrer("Referrer policy: unsafe-url", corsUrl, "unsafe-url", location.toString());
>+
>+done();
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..400c5c643027e7b2f9029474867bc7b6195cdb10
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status-expected.txt
>@@ -0,0 +1,29 @@
>+
>+PASS Preflight answered with status 200 
>+PASS Preflight answered with status 201 
>+PASS Preflight answered with status 202 
>+PASS Preflight answered with status 203 
>+PASS Preflight answered with status 204 
>+PASS Preflight answered with status 205 
>+PASS Preflight answered with status 206 
>+PASS Preflight answered with status 300 
>+PASS Preflight answered with status 301 
>+PASS Preflight answered with status 302 
>+PASS Preflight answered with status 303 
>+PASS Preflight answered with status 304 
>+PASS Preflight answered with status 305 
>+PASS Preflight answered with status 306 
>+PASS Preflight answered with status 307 
>+PASS Preflight answered with status 308 
>+PASS Preflight answered with status 400 
>+PASS Preflight answered with status 401 
>+PASS Preflight answered with status 402 
>+PASS Preflight answered with status 403 
>+PASS Preflight answered with status 404 
>+PASS Preflight answered with status 405 
>+PASS Preflight answered with status 501 
>+PASS Preflight answered with status 502 
>+PASS Preflight answered with status 503 
>+PASS Preflight answered with status 504 
>+PASS Preflight answered with status 505 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status-worker-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..400c5c643027e7b2f9029474867bc7b6195cdb10
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status-worker-expected.txt
>@@ -0,0 +1,29 @@
>+
>+PASS Preflight answered with status 200 
>+PASS Preflight answered with status 201 
>+PASS Preflight answered with status 202 
>+PASS Preflight answered with status 203 
>+PASS Preflight answered with status 204 
>+PASS Preflight answered with status 205 
>+PASS Preflight answered with status 206 
>+PASS Preflight answered with status 300 
>+PASS Preflight answered with status 301 
>+PASS Preflight answered with status 302 
>+PASS Preflight answered with status 303 
>+PASS Preflight answered with status 304 
>+PASS Preflight answered with status 305 
>+PASS Preflight answered with status 306 
>+PASS Preflight answered with status 307 
>+PASS Preflight answered with status 308 
>+PASS Preflight answered with status 400 
>+PASS Preflight answered with status 401 
>+PASS Preflight answered with status 402 
>+PASS Preflight answered with status 403 
>+PASS Preflight answered with status 404 
>+PASS Preflight answered with status 405 
>+PASS Preflight answered with status 501 
>+PASS Preflight answered with status 502 
>+PASS Preflight answered with status 503 
>+PASS Preflight answered with status 504 
>+PASS Preflight answered with status 505 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status-worker.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status-worker.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..7650c37d1ea37311a87b14226681b14d433269c2
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status-worker.html
>@@ -0,0 +1,18 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch in worker: preflight status code handling</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#cors-preflight-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-network-or-cache-fetch">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script>
>+      fetch_tests_from_worker(new Worker("cors-preflight-status.js?pipe=sub"));
>+    </script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..bc11fb755e6be35514d5016bacb7877a4d262f5a
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status.html
>@@ -0,0 +1,17 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch: preflight status code handling</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#cors-preflight-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-network-or-cache-fetch">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script src="/common/utils.js"></script>
>+    <script src="../resources/utils.js"></script>
>+    <script src="cors-preflight-status.js?pipe=sub"></script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status.js b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..07bd23c9003234ebdd5ed8d3cbdba5b5a275747f
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status.js
>@@ -0,0 +1,41 @@
>+if (this.document === undefined) {
>+  importScripts("/resources/testharness.js");
>+  importScripts("../resources/utils.js");
>+  importScripts("/common/utils.js");
>+}
>+
>+/* Check preflight is ok if status is ok status (200  to 299)*/
>+function corsPreflightStatus(desc, corsUrl, preflightStatus) {
>+  var uuid_token = token();
>+  var url = corsUrl;
>+  var requestInit = {"mode": "cors"};
>+  /* Force preflight */
>+  requestInit["headers"] = {"x-force-preflight": ""};
>+
>+  var urlParameters = "?token=" + uuid_token + "&max_age=0";
>+  urlParameters += "&allow_headers=x-force-preflight";
>+  urlParameters += "&preflight_status=" + preflightStatus;
>+
>+  promise_test(function(test) {
>+    fetch(RESOURCES_DIR + "clean-stash.py?token=" + uuid_token).then(function(resp) {
>+      assert_equals(resp.status, 200, "Clean stash response's status is 200");
>+      if (200 <= preflightStatus && 299 >= preflightStatus) {
>+        return fetch(url + urlParameters, requestInit).then(function(resp) {
>+          assert_equals(resp.status, 200, "Response's status is 200");
>+          assert_equals(resp.headers.get("x-did-preflight"), "1", "Preflight request has been made");
>+        });
>+      } else {
>+        return promise_rejects(test, new TypeError(), fetch(url + urlParameters, requestInit));
>+      }
>+    });
>+  }, desc);
>+}
>+
>+var corsUrl = "http://www1.{{host}}:{{ports[http][0]}}" + dirname(location.pathname) + RESOURCES_DIR + "preflight.py";
>+for (status of [200, 201, 202, 203, 204, 205, 206,
>+                300, 301, 302, 303, 304, 305, 306, 307, 308,
>+                400, 401, 402, 403, 404, 405,
>+                501, 502, 503, 504, 505])
>+  corsPreflightStatus("Preflight answered with status " + status, corsUrl, status);
>+
>+done();
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-worker-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..c2c15e0b8a0e54a623bcb4fdca1f4cef72eeb240
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-worker-expected.txt
>@@ -0,0 +1,3 @@
>+
>+PASS Untitled 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-worker.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-worker.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..bedef5d77511b1f535af9577130c96fdd22868eb
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-worker.html
>@@ -0,0 +1,20 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch in worker: Check cors fetches requiring prefligh</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-cors-protocol">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#simple-method">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#simple-header">
>+  </head>
>+  <body>
>+    <script>
>+      fetch_tests_from_worker(new Worker("cors-preflight.js?pipe=sub"));
>+    </script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..c4a581a55c5cc6b506e5dd886b0a3dd0c91de761
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight.html
>@@ -0,0 +1,20 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch: Check cors fetches requiring preflight</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-cors-protocol">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#simple-method">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#simple-header">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script src="../resources/utils.js"></script>
>+    <script src="/common/utils.js"></script>
>+    <script src="cors-preflight.js?pipe=sub"></script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight.js b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..60ecd186df130bb9a0a91af77503d08f136c8c39
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight.js
>@@ -0,0 +1,82 @@
>+if (this.document === undefined) {
>+  importScripts("/resources/testharness.js");
>+  importScripts("../resources/utils.js");
>+  importScripts("/common/utils.js");
>+}
>+
>+/*
>+  Check preflight is done
>+  Control if server allows method and headers and check accordingly
>+  Check control access headers added by UA (for method and headers)
>+*/
>+function corsPreflight(desc, corsUrl, method, allowed, headers) {
>+  var uuid_token = token();
>+  fetch(RESOURCES_DIR + "clean-stash.py?token=" + uuid_token).then(function(response) {
>+
>+    var url = corsUrl;
>+    var urlParameters = "?token=" + uuid_token + "&max_age=0";
>+    var requestInit = {"mode": "cors", "method": method};
>+    if (headers)
>+      requestInit["headers"] = headers;
>+
>+    if (allowed) {
>+      urlParameters += "&allow_methods=" + method;
>+      if (headers) {
>+        //Let's check prefligh request.
>+        //Server will send back headers from Access-Control-Request-Headers in x-control-request-headers
>+        urlParameters += "&control_request_headers"
>+        //Make the server allow the headers
>+        urlParameters += "&allow_headers="
>+        urlParameters += headers.join("%2C%20");
>+      }
>+      promise_test(function(test) {
>+        test.add_cleanup(function() {
>+          fetch(RESOURCES_DIR + "clean-stash.py?token=" + uuid_token);
>+        });
>+        return fetch(url + urlParameters, requestInit).then(function(resp) {
>+          assert_equals(resp.status, 200, "Response's status is 200");
>+          assert_equals(resp.headers.get("x-did-preflight"), "1", "Preflight request has been made");
>+          if (headers) {
>+            var actualHeaders = resp.headers.get("x-control-request-headers").split(",");
>+            for (var i in actualHeaders)
>+              actualHeaders[i] = actualHeaders[i].trim();
>+            for (var header in headers)
>+              assert_in_array(header, actualHeaders, "Preflight asked permission for header: " + header);
>+          }
>+        });
>+      }, desc);
>+    } else {
>+      promise_test(function(test) {
>+        test.add_cleanup(function() {
>+          fetch(RESOURCES_DIR + "clean-stash.py?token=" + uuid_token);
>+        });
>+        return promise_rejects(test, new TypeError(), fetch(url + urlParameters, requestInit));
>+      }, desc);
>+    }
>+  });
>+}
>+
>+var corsUrl = "http://www1.{{host}}:{{ports[http][0]}}" + dirname(location.pathname) + RESOURCES_DIR + "preflight.py";
>+
>+corsPreflight("CORS [DELETE], server allows", corsUrl, "DELETE", true);
>+corsPreflight("CORS [DELETE], server refuses", corsUrl, "DELETE", false);
>+corsPreflight("CORS [PUT], server allows", corsUrl, "PUT", true);
>+corsPreflight("CORS [PUT], server refuses", corsUrl, "PUT", false);
>+corsPreflight("CORS [PATCH], server allows", corsUrl, "PATCH", true);
>+corsPreflight("CORS [PATCH], server refuses", corsUrl, "PATCH", false);
>+corsPreflight("CORS [NEW], server allows", corsUrl, "NEW", true);
>+corsPreflight("CORS [NEW], server refuses", corsUrl, "NEW", false);
>+
>+corsPreflight("CORS [GET] [x-test-header: allowed], server allows", corsUrl, "GET", true, {"x-test-header1": "allowed"});
>+corsPreflight("CORS [GET] [x-test-header: refused], server refuses", corsUrl, "GET", false, {"x-test-header1": "refused"});
>+
>+var headers = {"x-test-header1": "allowedOrRefused",
>+               "x-test-header2": "allowedOrRefused",
>+               "x-test-header3": "allowedOrRefused",
>+};
>+corsPreflight("CORS [GET] [several headers], server allows", corsUrl, "GET", true, headers);
>+corsPreflight("CORS [GET] [several headers], server refuses", corsUrl, "GET", false, headers);
>+corsPreflight("CORS [PUT] [several headers], server allows", corsUrl, "PUT", true, headers);
>+corsPreflight("CORS [PUT] [several headers], server refuses", corsUrl, "PUT", false, headers);
>+
>+done();
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..60bce16f9ed1d3fa663e3e65b43ef8624a7bb6ca
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-expected.txt
>@@ -0,0 +1,65 @@
>+Blocked access to external URL http://www1.localhost:8800/fetch/api/resources/preflight.py?r=301&l=http://user:password@www1.localhost:8800/fetch/api/cors/../resources/preflight.py&count=1
>+
>+Harness Error (TIMEOUT), message = null
>+
>+TIMEOUT Redirect 301 from same origin to remote with user and password Test timed out
>+TIMEOUT Redirect 301 from same origin to remote with user Test timed out
>+TIMEOUT Redirect 301 from same origin to remote with password Test timed out
>+TIMEOUT Redirect 301 from remote to same origin with user and password Test timed out
>+TIMEOUT Redirect 301 from remote to same origin with user Test timed out
>+TIMEOUT Redirect 301 from remote to same origin with password Test timed out
>+TIMEOUT Redirect 301 from remote to another remote with user and password Test timed out
>+TIMEOUT Redirect 301 from remote to another remote with user Test timed out
>+TIMEOUT Redirect 301 from remote to another remote with password Test timed out
>+TIMEOUT Redirect 301 from remote to same remote with user and password Test timed out
>+TIMEOUT Redirect 301 from remote to same remote with user Test timed out
>+TIMEOUT Redirect 301 from remote to same remote with password Test timed out
>+TIMEOUT Redirect 302 from same origin to remote with user and password Test timed out
>+TIMEOUT Redirect 302 from same origin to remote with user Test timed out
>+TIMEOUT Redirect 302 from same origin to remote with password Test timed out
>+TIMEOUT Redirect 302 from remote to same origin with user and password Test timed out
>+TIMEOUT Redirect 302 from remote to same origin with user Test timed out
>+TIMEOUT Redirect 302 from remote to same origin with password Test timed out
>+TIMEOUT Redirect 302 from remote to another remote with user and password Test timed out
>+TIMEOUT Redirect 302 from remote to another remote with user Test timed out
>+TIMEOUT Redirect 302 from remote to another remote with password Test timed out
>+TIMEOUT Redirect 302 from remote to same remote with user and password Test timed out
>+TIMEOUT Redirect 302 from remote to same remote with user Test timed out
>+TIMEOUT Redirect 302 from remote to same remote with password Test timed out
>+TIMEOUT Redirect 303 from same origin to remote with user and password Test timed out
>+TIMEOUT Redirect 303 from same origin to remote with user Test timed out
>+TIMEOUT Redirect 303 from same origin to remote with password Test timed out
>+TIMEOUT Redirect 303 from remote to same origin with user and password Test timed out
>+TIMEOUT Redirect 303 from remote to same origin with user Test timed out
>+TIMEOUT Redirect 303 from remote to same origin with password Test timed out
>+TIMEOUT Redirect 303 from remote to another remote with user and password Test timed out
>+TIMEOUT Redirect 303 from remote to another remote with user Test timed out
>+TIMEOUT Redirect 303 from remote to another remote with password Test timed out
>+TIMEOUT Redirect 303 from remote to same remote with user and password Test timed out
>+TIMEOUT Redirect 303 from remote to same remote with user Test timed out
>+TIMEOUT Redirect 303 from remote to same remote with password Test timed out
>+TIMEOUT Redirect 307 from same origin to remote with user and password Test timed out
>+TIMEOUT Redirect 307 from same origin to remote with user Test timed out
>+TIMEOUT Redirect 307 from same origin to remote with password Test timed out
>+TIMEOUT Redirect 307 from remote to same origin with user and password Test timed out
>+TIMEOUT Redirect 307 from remote to same origin with user Test timed out
>+TIMEOUT Redirect 307 from remote to same origin with password Test timed out
>+TIMEOUT Redirect 307 from remote to another remote with user and password Test timed out
>+TIMEOUT Redirect 307 from remote to another remote with user Test timed out
>+TIMEOUT Redirect 307 from remote to another remote with password Test timed out
>+TIMEOUT Redirect 307 from remote to same remote with user and password Test timed out
>+TIMEOUT Redirect 307 from remote to same remote with user Test timed out
>+TIMEOUT Redirect 307 from remote to same remote with password Test timed out
>+TIMEOUT Redirect 308 from same origin to remote with user and password Test timed out
>+TIMEOUT Redirect 308 from same origin to remote with user Test timed out
>+TIMEOUT Redirect 308 from same origin to remote with password Test timed out
>+TIMEOUT Redirect 308 from remote to same origin with user and password Test timed out
>+TIMEOUT Redirect 308 from remote to same origin with user Test timed out
>+TIMEOUT Redirect 308 from remote to same origin with password Test timed out
>+TIMEOUT Redirect 308 from remote to another remote with user and password Test timed out
>+TIMEOUT Redirect 308 from remote to another remote with user Test timed out
>+TIMEOUT Redirect 308 from remote to another remote with password Test timed out
>+TIMEOUT Redirect 308 from remote to same remote with user and password Test timed out
>+TIMEOUT Redirect 308 from remote to same remote with user Test timed out
>+TIMEOUT Redirect 308 from remote to same remote with password Test timed out
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-worker-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..52a62a412bc899ad76cc6669f82071ff0d68f200
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-worker-expected.txt
>@@ -0,0 +1,62 @@
>+
>+PASS Redirect 301 from same origin to remote with user and password 
>+PASS Redirect 301 from same origin to remote with user 
>+PASS Redirect 301 from same origin to remote with password 
>+PASS Redirect 301 from remote to same origin with user and password 
>+PASS Redirect 301 from remote to same origin with user 
>+PASS Redirect 301 from remote to same origin with password 
>+PASS Redirect 301 from remote to another remote with user and password 
>+PASS Redirect 301 from remote to another remote with user 
>+PASS Redirect 301 from remote to another remote with password 
>+PASS Redirect 301 from remote to same remote with user and password 
>+PASS Redirect 301 from remote to same remote with user 
>+PASS Redirect 301 from remote to same remote with password 
>+PASS Redirect 302 from same origin to remote with user and password 
>+PASS Redirect 302 from same origin to remote with user 
>+PASS Redirect 302 from same origin to remote with password 
>+PASS Redirect 302 from remote to same origin with user and password 
>+PASS Redirect 302 from remote to same origin with user 
>+PASS Redirect 302 from remote to same origin with password 
>+PASS Redirect 302 from remote to another remote with user and password 
>+PASS Redirect 302 from remote to another remote with user 
>+PASS Redirect 302 from remote to another remote with password 
>+PASS Redirect 302 from remote to same remote with user and password 
>+PASS Redirect 302 from remote to same remote with user 
>+PASS Redirect 302 from remote to same remote with password 
>+PASS Redirect 303 from same origin to remote with user and password 
>+PASS Redirect 303 from same origin to remote with user 
>+PASS Redirect 303 from same origin to remote with password 
>+PASS Redirect 303 from remote to same origin with user and password 
>+PASS Redirect 303 from remote to same origin with user 
>+PASS Redirect 303 from remote to same origin with password 
>+PASS Redirect 303 from remote to another remote with user and password 
>+PASS Redirect 303 from remote to another remote with user 
>+PASS Redirect 303 from remote to another remote with password 
>+PASS Redirect 303 from remote to same remote with user and password 
>+PASS Redirect 303 from remote to same remote with user 
>+PASS Redirect 303 from remote to same remote with password 
>+PASS Redirect 307 from same origin to remote with user and password 
>+PASS Redirect 307 from same origin to remote with user 
>+PASS Redirect 307 from same origin to remote with password 
>+PASS Redirect 307 from remote to same origin with user and password 
>+PASS Redirect 307 from remote to same origin with user 
>+PASS Redirect 307 from remote to same origin with password 
>+PASS Redirect 307 from remote to another remote with user and password 
>+PASS Redirect 307 from remote to another remote with user 
>+PASS Redirect 307 from remote to another remote with password 
>+PASS Redirect 307 from remote to same remote with user and password 
>+PASS Redirect 307 from remote to same remote with user 
>+PASS Redirect 307 from remote to same remote with password 
>+PASS Redirect 308 from same origin to remote with user and password 
>+PASS Redirect 308 from same origin to remote with user 
>+PASS Redirect 308 from same origin to remote with password 
>+PASS Redirect 308 from remote to same origin with user and password 
>+PASS Redirect 308 from remote to same origin with user 
>+PASS Redirect 308 from remote to same origin with password 
>+PASS Redirect 308 from remote to another remote with user and password 
>+PASS Redirect 308 from remote to another remote with user 
>+PASS Redirect 308 from remote to another remote with password 
>+PASS Redirect 308 from remote to same remote with user and password 
>+PASS Redirect 308 from remote to same remote with user 
>+PASS Redirect 308 from remote to same remote with password 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-worker.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-worker.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..38e3e78ac5137ebc936722835054076246a103b5
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-worker.html
>@@ -0,0 +1,16 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch in worker: redirection url has credentials</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-fetch">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script>
>+      fetch_tests_from_worker(new Worker("cors-redirect-credentials.js"));
>+    </script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..2491f692d10a06cbcd005518191e1f69d644a9ba
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials.html
>@@ -0,0 +1,15 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch: redirection url has credentials</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-fetch">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script src="../resources/utils.js"></script>
>+    <script src="cors-redirect-credentials.js?pipe=sub"></script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials.js b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..ce0ef2d0b268a9b1f2feb028ab36c87750663914
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials.js
>@@ -0,0 +1,47 @@
>+if (this.document === undefined) {
>+  importScripts("/resources/testharness.js");
>+  importScripts("../resources/utils.js");
>+}
>+
>+function corsRedirectCredentials(desc, redirectUrl, redirectLocation, redirectStatus, locationCredentials) {
>+
>+  var url = redirectUrl
>+  var urlParameters = "?redirect_status=" + redirectStatus;
>+  urlParameters += "&location=" + encodeURIComponent(redirectLocation.replace("://", "://" + locationCredentials + "@"));
>+
>+  var requestInit = {"mode": "cors", "redirect": "follow", "credentials":"include"};
>+
>+  promise_test(function(test) {
>+    return promise_rejects(test, new TypeError(), fetch(url + urlParameters, requestInit));
>+  }, desc);
>+}
>+
>+var redirPath = dirname(location.pathname) + RESOURCES_DIR + "redirect.py";
>+var preflightPath = dirname(location.pathname) + RESOURCES_DIR + "preflight.py";
>+
>+var localRedirect = "http://{{host}}:{{ports[http][0]}}" + redirPath;
>+var remoteRedirect = "http://www1.{{host}}:{{ports[http][0]}}" + redirPath;
>+
>+var localLocation = "http://{{host}}:{{ports[http][0]}}" + preflightPath;
>+var remoteLocation = "http://www1.{{host}}:{{ports[http][0]}}" + preflightPath;
>+var remoteLocation2 = "http://www.{{host}}:{{ports[http][0]}}" + preflightPath;
>+
>+for (var code of [301, 302, 303, 307, 308]) {
>+  corsRedirectCredentials("Redirect " + code + " from same origin to remote with user and password", localRedirect, remoteLocation, code, "user:password");
>+  corsRedirectCredentials("Redirect " + code + " from same origin to remote with user", localRedirect, remoteLocation, code, "user:");
>+  corsRedirectCredentials("Redirect " + code + " from same origin to remote with password", localRedirect, remoteLocation, code, ":password");
>+
>+  corsRedirectCredentials("Redirect " + code + " from remote to same origin with user and password", remoteRedirect, localLocation, code, "user:password");
>+  corsRedirectCredentials("Redirect " + code + " from remote to same origin with user", remoteRedirect, localLocation, code, "user:");
>+  corsRedirectCredentials("Redirect " + code + " from remote to same origin with password", remoteRedirect, localLocation, code, ":password");
>+
>+  corsRedirectCredentials("Redirect " + code + " from remote to another remote with user and password", remoteRedirect, remoteLocation2, code, "user:password");
>+  corsRedirectCredentials("Redirect " + code + " from remote to another remote with user", remoteRedirect, remoteLocation2, code, "user:");
>+  corsRedirectCredentials("Redirect " + code + " from remote to another remote with password", remoteRedirect, remoteLocation2, code, ":password");
>+
>+  corsRedirectCredentials("Redirect " + code + " from remote to same remote with user and password", remoteRedirect, remoteLocation, code, "user:password");
>+  corsRedirectCredentials("Redirect " + code + " from remote to same remote with user", remoteRedirect, remoteLocation, code, "user:");
>+  corsRedirectCredentials("Redirect " + code + " from remote to same remote with password", remoteRedirect, remoteLocation, code, ":password");
>+}
>+
>+done();
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..a5a7b25600592f3be3ddb06ee42a71710ac52d4e
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-expected.txt
>@@ -0,0 +1,22 @@
>+
>+PASS Redirect 301: cors to same cors 
>+PASS Redirect 301: cors to another cors 
>+PASS Redirect 301: same origin to cors 
>+PASS Redirect 301: cors to same origin 
>+PASS Redirect 302: cors to same cors 
>+PASS Redirect 302: cors to another cors 
>+PASS Redirect 302: same origin to cors 
>+PASS Redirect 302: cors to same origin 
>+PASS Redirect 303: cors to same cors 
>+PASS Redirect 303: cors to another cors 
>+PASS Redirect 303: same origin to cors 
>+PASS Redirect 303: cors to same origin 
>+PASS Redirect 307: cors to same cors 
>+PASS Redirect 307: cors to another cors 
>+PASS Redirect 307: same origin to cors 
>+PASS Redirect 307: cors to same origin 
>+PASS Redirect 308: cors to same cors 
>+PASS Redirect 308: cors to another cors 
>+PASS Redirect 308: same origin to cors 
>+PASS Redirect 308: cors to same origin 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-worker-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..a5a7b25600592f3be3ddb06ee42a71710ac52d4e
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-worker-expected.txt
>@@ -0,0 +1,22 @@
>+
>+PASS Redirect 301: cors to same cors 
>+PASS Redirect 301: cors to another cors 
>+PASS Redirect 301: same origin to cors 
>+PASS Redirect 301: cors to same origin 
>+PASS Redirect 302: cors to same cors 
>+PASS Redirect 302: cors to another cors 
>+PASS Redirect 302: same origin to cors 
>+PASS Redirect 302: cors to same origin 
>+PASS Redirect 303: cors to same cors 
>+PASS Redirect 303: cors to another cors 
>+PASS Redirect 303: same origin to cors 
>+PASS Redirect 303: cors to same origin 
>+PASS Redirect 307: cors to same cors 
>+PASS Redirect 307: cors to another cors 
>+PASS Redirect 307: same origin to cors 
>+PASS Redirect 307: cors to same origin 
>+PASS Redirect 308: cors to same cors 
>+PASS Redirect 308: cors to another cors 
>+PASS Redirect 308: same origin to cors 
>+PASS Redirect 308: cors to same origin 
>+
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-worker.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-worker.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..bf7bd965272a846d92bfa469deb4bc4e52190493
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-worker.html
>@@ -0,0 +1,17 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch in worker: CORS Redirection with several origins</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-network-or-cache-fetch">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script>
>+      fetch_tests_from_worker(new Worker("cors-redirect.js?pipe=sub"));
>+    </script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect.html b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..f88eacf7bc57f8753161123a934066243620bf10
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect.html
>@@ -0,0 +1,17 @@
>+<!doctype html>
>+<html>
>+  <head>
>+    <meta charset="utf-8">
>+    <title>Fetch:  CORS Redirection with several origins</title>
>+    <meta name="author" title="Canon Research France" href="https://www.crf.canon.fr">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#main-fetch">
>+    <meta name="help" href="https://fetch.spec.whatwg.org/#http-network-or-cache-fetch">
>+    <script src="/resources/testharness.js"></script>
>+    <script src="/resources/testharnessreport.js"></script>
>+  </head>
>+  <body>
>+    <script src="/common/utils.js"></script>
>+    <script src="../resources/utils.js"></script>
>+    <script src="cors-redirect.js?pipe=sub"></script>
>+  </body>
>+</html>
>\ No newline at end of file
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect.js b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..a818054ab102d9304ca8b08bc0575a04511eccfe
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect.js
>@@ -0,0 +1,44 @@
>+if (this.document === undefined) {
>+  importScripts("/resources/testharness.js");
>+  importScripts("/common/utils.js");
>+  importScripts("../resources/utils.js");
>+}
>+
>+function corsRedirect(desc, redirectUrl, redirectLocation, redirectStatus, expectedOrigin) {
>+  var uuid_token = token();
>+  var url = redirectUrl;
>+  var urlParameters = "?token=" + uuid_token + "&max_age=0";
>+  urlParameters += "&redirect_status=" + redirectStatus;
>+  urlParameters += "&location=" + encodeURIComponent(redirectLocation);
>+
>+  var requestInit = {"mode": "cors", "redirect": "follow"};
>+
>+  promise_test(function(test) {
>+    fetch(RESOURCES_DIR + "clean-stash.py?token=" + uuid_token).then(function(resp) {
>+      return fetch(url + urlParameters, requestInit).then(function(resp) {
>+        assert_equals(resp.status, 200, "Response's status is 200");
>+        assert_equals(resp.headers.get("x-did-preflight"), "0", "No preflight request has been made");
>+        assert_equals(resp.headers.get("x-origin"), expectedOrigin, "Origin is correctly set after redirect");
>+      });
>+    });
>+  }, desc);
>+}
>+
>+var redirPath = dirname(location.pathname) + RESOURCES_DIR + "redirect.py";
>+var preflightPath = dirname(location.pathname) + RESOURCES_DIR + "preflight.py";
>+
>+var localRedirect = "http://{{host}}:{{ports[http][0]}}" + redirPath;
>+var remoteRedirect = "http://www1.{{host}}:{{ports[http][0]}}" + redirPath;
>+
>+var localLocation = "http://{{host}}:{{ports[http][0]}}" + preflightPath;
>+var remoteLocation = "http://www1.{{host}}:{{ports[http][0]}}" + preflightPath;
>+var remoteLocation2 = "http://www.{{host}}:{{ports[http][0]}}" + preflightPath;
>+
>+for (var code of [301, 302, 303, 307, 308]) {
>+  corsRedirect("Redirect " + code + ": cors to same cors", remoteRedirect, remoteLocation, code, location.origin);
>+  corsRedirect("Redirect " + code + ": cors to another cors", remoteRedirect, remoteLocation2, code, "null");
>+  corsRedirect("Redirect " + code + ": same origin to cors", localRedirect, remoteLocation, code, location.origin);
>+  corsRedirect("Redirect " + code + ": cors to same origin", remoteRedirect, localLocation, code, "null");
>+}
>+
>+done();
>diff --git a/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/w3c-import.log
>new file mode 100644
>index 0000000000000000000000000000000000000000..5606cff321a9ffb53f1cd69b421364bcfa94f769
>--- /dev/null
>+++ b/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/w3c-import.log
>@@ -0,0 +1,53 @@
>+The tests in this directory were imported from the W3C repository.
>+Do NOT modify these tests directly in Webkit.
>+Instead, create a pull request on the W3C CSS or WPT github:
>+	https://github.com/w3c/csswg-test
>+	https://github.com/w3c/web-platform-tests
>+
>+Then run the Tools/Scripts/import-w3c-tests in Webkit to reimport
>+
>+Do NOT modify or remove this file
>+
>+------------------------------------------------------------------------
>+Properties requiring vendor prefixes:
>+None
>+Property values requiring vendor prefixes:
>+None
>+------------------------------------------------------------------------
>+List of files:
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic-worker.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-basic.js
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies-worker.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies.js
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering-worker.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-filtering.js
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins-worker.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-multiple-origins.js
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight-worker.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight.js
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin-worker.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-origin.js
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect-worker.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-redirect.js
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer-worker.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-referrer.js
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status-worker.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-status.js
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight-worker.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-preflight.js
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials-worker.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-credentials.js
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect-worker.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect.html
>+/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-redirect.js

Actions: View | Formatted Diff | Diff

Attachments on bug 156753: 276738 | 276746 | 276751 | 284491 | 284494 | 284496 | 284605 | 284613 | 284620