// Serves the well-known response for WebAuthn related-origin tests.
// The response content is controlled by the shared state key "webauthn-related-origin-state",
// which is set by well-known-webauthn-state.sjs.
function handleRequest(request, response) {
// When accessed directly as a redirect target (not via ^headers^), return a
// valid well-known response without consulting shared state.
if (request.queryString.includes("direct")) {
response.setStatusLine(request.httpVersion, 200, "OK");
response.setHeader("Content-Type", "application/json");
response.write(JSON.stringify({ origins: ["https://example.com"] }));
return;
}
// Intermediate HTTP hop for the http_to_https_redirect test: redirect back to
// the HTTPS endpoint so the chain is https: -> http: -> https:.
if (request.queryString.includes("http_to_https")) {
response.setStatusLine(request.httpVersion, 302, "Found");
response.setHeader(
"Location",
"https://example.org/tests/dom/webauthn/tests/webauthn-wellknown.sjs?direct"
);
return;
}
const state = getSharedState("webauthn-related-origin-state") || "valid";
if (state === "timeout") {
response.processAsync();
// Never calls response.finish() — the XHR timeout closes the connection.
return;
}
switch (state) {
case "invalid_json":
response.write("not valid json");
break;
case "origins_not_array":
response.write(JSON.stringify({ origins: "https://example.com" }));
break;
case "origins_missing":
response.write(JSON.stringify({ not_origins: [] }));
break;
case "caller_not_listed":
response.write(JSON.stringify({ origins: ["https://example.net"] }));
break;
case "all_invalid_urls":
response.write(
JSON.stringify({
origins: ["not-a-url", "javascript:alert(1)", "data:text/plain,x"],
})
);
break;
case "no_registrable_domain":
// IP addresses, localhost, and bare TLDs have no registrable domain;
// getBaseDomainFromHost throws for them (step 4.3 continue). Caller is
// absent, so validation fails.
response.write(
JSON.stringify({
origins: [
"https:// style='color: green'>192.0.2.1/",
"https://localhost/",
"https://[::1]/",
"https://com",
"https://co.uk",
],
})
);
break;
case "mixed_no_registrable_domain":
// Same entries as above but the valid caller origin is also present, so
// the IP/localhost entries are skipped and validation succeeds.
response.write(
JSON.stringify({
origins: [
"https:// style='color: green'>192.0.2.1/",
"https://localhost/",
"https://[::1]/",
"https://com",
"https://co.uk",
"https://example.com",
],
})
);
break;
case "max_labels_exceeded":
// 6 distinct non-caller labels fill labelsSeen to the limit (5), so when
// "https://example.com" is processed its label "example" is not in the
// set and it gets skipped.
response.write(
JSON.stringify({
origins: [
"https://example1.com",
"https://example2.com",
"https://example3.com",
"https://example4.com",
"https://example5.com",
"https://example6.com",
"https://example.com",
],
})
);
break;
case "max_labels_exactly_five":
// 4 distinct non-caller labels; caller occupies the 5th slot (labelsSeen
// has room) so it is not skipped and the origin check succeeds.
response.write(
JSON.stringify({
origins: [
"https://example1.com",
"https://example2.com",
"https://example3.com",
"https://example4.com",
"https://example.com",
],
})
);
break;
case "label_seen_before_limit":
// "sub.example.com" adds label "example" to labelsSeen early. After 4
// more distinct labels fill labelsSeen to 5, "example5.com" is skipped
// (new label), but "example.com" is not skipped because "example" is
// already in labelsSeen.
response.write(
JSON.stringify({
origins: [
"https://sub.example.com",
"https://example1.com",
"https://example2.com",
"https://example3.com",
"https://example4.com",
"https://example5.com",
"https://example.com",
],
})
);
break;
case "mixed_valid_invalid":
// Invalid URLs are skipped; the valid caller origin is found.
response.write(
JSON.stringify({
origins: [
"not-a-url",
"javascript:alert(1)",
"data:text/plain,x",
"https://example.com",
"invalid",
],
})
);
break;
case "multi_part_tld_label":
// getBaseDomainFromHost("subdomain.example.co.uk") returns "example.co.uk";
// slicing before the first dot gives label "example", not "example.co".
// That label fills one labelsSeen slot. After 4 more labels the set is
// full, but when "https://example.com" (also label "example") is
// processed it is not skipped because "example" is already in labelsSeen.
response.write(
JSON.stringify({
origins: [
"https://subdomain.example.co.uk",
"https://example1.com",
"https://example2.com",
"https://example3.com",
"https://example4.com",
"https://example.com",
],
})
);
break;
default:
response.write(JSON.stringify({ origins: ["https://example.com"] }));
break;
}
}
