Index: third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp |
diff --git a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp |
index b9cf5ab7b43f3fe65ffcb5186ca8893d8ebabe1c..91188b57fbf107336e00b9d22827900354745acf 100644 |
--- a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp |
+++ b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp |
@@ -1468,7 +1468,12 @@ void XMLHttpRequest::didFail(const ResourceError& error) { |
if (m_error) |
return; |
- if (error.isCancellation()) { |
+ // Internally, access check violations are considered `cancellations`, but |
+ // at least the mixed-content and CSP specs require them to be surfaced as |
+ // network errors to the page. See: |
+ // [1] https://www.w3.org/TR/mixed-content/#algorithms, |
+ // [2] https://www.w3.org/TR/CSP3/#fetch-integration. |
+ if (error.isCancellation() && !error.isAccessCheck()) { |
handleDidCancel(); |
return; |
} |