How to reproduce; - Add some upcoming events in your Google calendar - Enable Google calendar widget in GMail Lab settings Expected behaviour: Calendar widget shows upcoming events. Current behaviour: Upcoming event list is empty. Used to work in older WebKit revisions (Safari 4 Beta works fine), so this is a regression.
This regressed between the r41545 and r41698 nightlies. I'll try to find the exact point of regression by bisecting local builds.
This regressed in r41547: http://trac.webkit.org/changeset/41547 This is probably not our bug, so I'll put it in the Evangelism component.
You can see the console spam from attempts to set headers that are no longer allowed by the XHR spec.
Marking this P2 because it's an evangelism bug.
The headers that give messages in the console are the Authorization and Connection headers. Since the Connection header was already disallowed before r41547, it must be the Authorization header that is causing problems. I also get the following message: Unsafe JavaScript attempt to access frame with URL http://mail.google.com/mail/?ui=2&view=bsp&ver=1qygpcgurkovy from frame with URL https://www.google.com/calendar/mgadget?container=gm&v=48f45299de1a1e3b68bad2f5c3c6a20&lang=en&country=CA&view=default&rpctoken=w4ie8s41p89w&libs=js%2Fdynamic-height%3Agoogle.waitforload%3Arpc%3Asetprefs.js%3Aauth-refresh&parent=http%3A%2F%2Fmail.google.com%2Fmail%2Fhtml&pid=&up_calendarColors=(%23A32929)&up_calendarFeeds=(cwzwarich%2540gmail.com)&up_dateFormat=0&up_firstDay=0&up_hideAgenda=0&up_showDatepicker=false&up_showEmptyDays=0&up_showExpiredEvents=true&up_timeFormat=1%3A00pm&mid=0#st=e%3DAA6WCYaIzsKw7izCIrnHKw5hc1jwPTFciJoWcejS8SSVvhuWd2HrcK7TPIdwENlQSnoKyDBn2FW90sH95htVajbKNmqLdQckrjis6UL%252B3k1Vt1G2GGHPLBjf%252BfsGovdPU8Sgk0%252F67HqV%26c%3Dgm. Domains, protocols and ports must match.
I am not aware of any real reason to block the Authorization header, other than following the spec. Anne, are you? Undoing this part of the change may be a better solution than evangelizing Google.
I've filed a Google bug on the issue: http://b/1749893
Also reported to the public Chromium bug tracker at http://code.google.com/p/chromium/issues/detail?id=8935
Created attachment 29160 [details] proposed fix So far, there seems to be no resistance to the idea of removing Authorization from the list of forbidden headers on public-webapps mailing list.
Fix looks good to me.
Comment on attachment 29160 [details] proposed fix r=me
Committed <http://trac.webkit.org/changeset/42314>. Please verify that this actually fixes the calendar widget - I don't use it, so I didn't attempt to.
Verified.