Implemented CORS mechanism

README.md

@@ -179,7 +179,7 @@ You may still encounter errors or crashes. Please open an issue with specifics i
 
 Here are the key features we have implemented:
 
-- [ ] CORS [#2015](https://github.com/lightpanda-io/browser/issues/2015)
+- [x] CORS ([CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS))
 - [x] HTTP loader ([Libcurl](https://curl.se/libcurl/))
 - [x] HTML parser ([html5ever](https://github.com/servo/html5ever))
 - [x] DOM tree

src/browser/tests/net/fetch.html

@@ -330,3 +330,84 @@
     });
   }
 </script>
+
+<script id=fetch_cors_ok type=module>
+  {
+    const state = await testing.async();
+    const response = await fetch('http://localhost:9582/cors/ok');
+    const text = await response.text();
+
+    state.resolve();
+
+    await state.done(() => {
+      testing.expectEqual(200, response.status);
+      testing.expectEqual(true, response.ok);
+      testing.expectEqual('cors', response.type);
+      testing.expectEqual('cors-ok', text);
+      testing.expectEqual('text/plain', response.headers.get('Content-Type'));
+      testing.expectEqual('allowed', response.headers.get('X-Test-Header'));
+      testing.expectEqual(null, response.headers.get('X-Blocked'));
+      testing.expectEqual(null, response.headers.get('Content-Length'));
+    });
+  }
+</script>
+
+<script id=fetch_cors_credentials type=module>
+  {
+    const state = await testing.async();
+    const response = await fetch('http://localhost:9582/cors/cred', {
+      credentials: 'include'
+    });
+    const text = await response.text();
+
+    state.resolve();
+
+    await state.done(() => {
+      testing.expectEqual(200, response.status);
+      testing.expectEqual(true, response.ok);
+      testing.expectEqual('cors', response.type);
+      testing.expectEqual('cors-cred', text);
+      testing.expectEqual('allowed', response.headers.get('X-Test-Header'));
+    });
+  }
+</script>
+
+<script id=fetch_cors_blocked type=module>
+  {
+    const state = await testing.async();
+    try {
+      await fetch('http://localhost:9582/cors/block');
+      state.resolve({ ok: false });
+    } catch (e) {
+      state.resolve({ ok: true, name: e.name });
+    }
+
+    await state.done((result) => {
+      testing.expectEqual(true, result.ok);
+      testing.expectEqual('TypeError', result.name);
+    });
+  }
+</script>
+
+<script id=fetch_cors_non_simple_blocked type=module>
+  {
+    const state = await testing.async();
+    try {
+      await fetch('http://localhost:9582/cors/ok', {
+        method: 'POST',
+        headers: {
+          'X-Custom-Header': '1'
+        },
+        body: 'hi'
+      });
+      state.resolve({ ok: false });
+    } catch (e) {
+      state.resolve({ ok: true, name: e.name });
+    }
+
+    await state.done((result) => {
+      testing.expectEqual(true, result.ok);
+      testing.expectEqual('TypeError', result.name);
+    });
+  }
+</script>

src/browser/tests/net/xhr.html

@@ -386,3 +386,76 @@
     });
   }
 </script>
+
+<script id=xhr_cors_ok type=module>
+  {
+    const state = await testing.async();
+    const req = new XMLHttpRequest();
+    req.onload = () => { state.resolve({ ok: true }); };
+    req.onerror = () => { state.resolve({ ok: false }); };
+    req.open('GET', 'http://localhost:9582/cors/ok');
+    req.send();
+
+    await state.done((result) => {
+      testing.expectEqual(true, result.ok);
+      testing.expectEqual(200, req.status);
+      testing.expectEqual('cors-ok', req.responseText);
+      testing.expectEqual('allowed', req.getResponseHeader('X-Test-Header'));
+      testing.expectEqual(null, req.getResponseHeader('X-Blocked'));
+      const all = req.getAllResponseHeaders();
+      testing.expectEqual(false, all.toLowerCase().includes('x-blocked'));
+    });
+  }
+</script>
+
+<script id=xhr_cors_credentials type=module>
+  {
+    const state = await testing.async();
+    const req = new XMLHttpRequest();
+    req.onload = () => { state.resolve({ ok: true }); };
+    req.onerror = () => { state.resolve({ ok: false }); };
+    req.withCredentials = true;
+    req.open('GET', 'http://localhost:9582/cors/cred');
+    req.send();
+
+    await state.done((result) => {
+      testing.expectEqual(true, result.ok);
+      testing.expectEqual(200, req.status);
+      testing.expectEqual('cors-cred', req.responseText);
+      testing.expectEqual('allowed', req.getResponseHeader('X-Test-Header'));
+    });
+  }
+</script>
+
+<script id=xhr_cors_blocked type=module>
+  {
+    const state = await testing.async();
+    const req = new XMLHttpRequest();
+    req.onload = () => { state.resolve({ ok: false }); };
+    req.onerror = () => { state.resolve({ ok: true }); };
+    req.open('GET', 'http://localhost:9582/cors/block');
+    req.send();
+
+    await state.done((result) => {
+      testing.expectEqual(true, result.ok);
+      testing.expectEqual(0, req.status);
+    });
+  }
+</script>
+
+<script id=xhr_cors_non_simple_blocked type=module>
+  {
+    const state = await testing.async();
+    const req = new XMLHttpRequest();
+    req.onload = () => { state.resolve({ ok: false }); };
+    req.onerror = () => { state.resolve({ ok: true }); };
+    req.open('POST', 'http://localhost:9582/cors/ok');
+    req.setRequestHeader('X-Custom-Header', '1');
+    req.send('hi');
+
+    await state.done((result) => {
+      testing.expectEqual(true, result.ok);
+      testing.expectEqual(0, req.status);
+    });
+  }
+</script>