Carve out an exception for embedded credentials in XHR.

third_party/WebKit/Source/core/loader/FrameFetchContext.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 815 matching lines @@
             GetFrame()->GetDocument()->GetSecurityOrigin()->Protocol())) {
       Deprecation::CountDeprecation(
           GetFrame()->GetDocument(),
           UseCounter::kLegacyProtocolEmbeddedAsSubresource);
 
       // TODO(mkwst): Enabled by default in M59. Drop the runtime-enabled check
       // in M60: https://www.chromestatus.com/feature/5709390967472128
       if (RuntimeEnabledFeatures::blockLegacySubresourcesEnabled())
         return ResourceRequestBlockedReason::kOrigin;
     }
-    if (!url.User().IsEmpty() || !url.Pass().IsEmpty()) {
+
+    if ((!url.User().IsEmpty() || !url.Pass().IsEmpty()) &&
+        resource_request.GetRequestContext() !=
+            WebURLRequest::kRequestContextXMLHttpRequest) {
       Deprecation::CountDeprecation(
           GetFrame()->GetDocument(),
           UseCounter::kRequestedSubresourceWithEmbeddedCredentials);
       // TODO(mkwst): Remove the runtime-enabled check in M59:
       // https://www.chromestatus.com/feature/5669008342777856
       if (RuntimeEnabledFeatures::blockCredentialedSubresourcesEnabled())
         return ResourceRequestBlockedReason::kOrigin;
     }
   }
 
@@ skipping 240 matching lines @@
   return GetFrame()->FrameScheduler()->LoadingTaskRunner();
 }
 
 DEFINE_TRACE(FrameFetchContext) {
   visitor->Trace(document_);
   visitor->Trace(document_loader_);
   FetchContext::Trace(visitor);
 }
 
 }  // namespace blink