<!DOCTYPE html>
<html>
<head>
  <!-- Headers:
    Content-Security-Policy: default-src 'none'; script-src 'unsafe-inline' 'self'; img-src 'self'; style-src 'self'
    Link: </content-security-policy/support/fail.png>;rel=prefetch
  -->
  <script src='/resources/testharness.js'></script>
  <script src='/resources/testharnessreport.js'></script>
  <script src='/content-security-policy/support/testharness-helper.js'></script>
  <script src='/content-security-policy/support/prefetch-helper.js'></script>
  <script>
    async_test(t => {
      let url = window.origin + '/content-security-policy/support/fail.png';
      waitUntilCSPEventForURL(t, url)
        .then(t.step_func_done(e => {
          assert_equals(e.violatedDirective, 'prefetch-src');

          // This assert verifies both that the resource wasn't downloaded
          // when prefetched via `Link` on both this document itself, and
          // on the stylesheet subresource below.
          assert_resource_not_downloaded(t, url);
        }));

        // Load a stylesheet that tries to trigger a prefetch:
        let link = document.createElement('link');
        link.rel = 'stylesheet';
        link.href = '/content-security-policy/support/prefetch-subresource.css';
        document.head.appendChild(link);
    }, 'Prefetch via `Link` header blocked when allowed by default-src');
  </script>
</head>
<body>
</body>
</html>


