allowed-end-of-chain-because-of-same-origin.sub.html

<!DOCTYPE html>

<head>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
</head>

<body>
<script>
  var t = async_test("Test that the child iframe navigation is allowed");
  window.onmessage = t.step_func_done(function(e) {
    assert_equals(e.data.result, 'success');
  });

  // the iframe will navigate to:
  //    [www2]/..../redirect.py (which is not in the navigate-to source list) which will in turn navigate to
  //    [www1]/..../post_message_to_frame_owner.html which is not exactly in
  // the list but the check should be reduced to an origin check since there has been a redirect.
  // Because of 'unsafe-allow-redirects' only the second one is checked since the first is a redirect

  var i = document.createElement('iframe');
  i.src = "../support/link_click_navigation.sub.html" +
    "?csp=" + encodeURIComponent("navigate-to {{location[scheme]}}://{{domains[www1]}}:{{location[port]}}/some-path/ 'unsafe-allow-redirects'") +
    "&target=" + encodeURIComponent("{{location[scheme]}}://{{domains[www2]}}:{{location[port]}}/common/redirect.py?location=" +
                                     encodeURIComponent("{{location[scheme]}}://{{domains[www1]}}:{{location[port]}}/content-security-policy/navigate-to/support/post_message_to_frame_owner.html"));
  document.body.appendChild(i);
</script>

</body>

chromium/third_party/blink/web_tests/external/wpt/content-security-policy/navigate-to/unsafe-allow-redirects/allowed-end-of-chain-because-of-same-origin.sub.html