Save-Data should not be added to CORS Access-Control-Request-Headers

third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp

Index: third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
diff --git a/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp b/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
index 672aebb6adf022d6309b0c385037d1fafb0a7101..61cc25d0184ce6528b22302e3d9392746fa787e2 100644
--- a/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
+++ b/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
@@ -94,6 +94,13 @@ ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& reque
                 // Access-Control-Request-Headers header.
                 continue;
             }
+            if (equalIgnoringCase(header.key, "save-data")) {
+                // As a short-term fix, exclude Save-Data from
+                // Access-Control-Request-Headers header.
+                // TODO(crbug.com/601092): Longer-term all simple headers should
+                // be excluded as well.
+                continue;
+            }
             headers.append(header.key.lower());
         }
         std::sort(headers.begin(), headers.end(), WTF::codePointCompareLessThan);