Index: third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp |
diff --git a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp |
index e4caac40bb90dc83ab950f47f4609b065ff58444..abe32fc82d15ac6a3e8c76cf9cdd278fcaee9045 100644 |
--- a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp |
+++ b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp |
@@ -1365,7 +1365,12 @@ void XMLHttpRequest::didFail(const ResourceError& error) |
if (m_error) |
return; |
- if (error.isCancellation()) { |
+ // Internally, access check violations are considered `cancellations`, but |
+ // at least the mixed-content and CSP specs require them to be surfaced as |
+ // network errors to the page. See: |
+ // [1] https://www.w3.org/TR/mixed-content/#algorithms, |
+ // [2] https://www.w3.org/TR/CSP3/#fetch-integration. |
+ if (error.isCancellation() && !error.isAccessCheck()) { |
handleDidCancel(); |
return; |
} |