Since v38, Chrome extension cannot load from HTTP URLs anymore, workaround?

The users of our website run our Chrome plugin which, amongst other things, performs cross-origin requests via XMLHttpRequest as described on the Chrome extension development pages. This has been running just fine for a few years now. However, ever since our users upgraded to the latest version of Chrome (v38), these requests have failed. Our site runs on HTTPS and some of the URLs loaded via our content script are on HTTP. The message is:

[blocked] The page at 'https://www.ourpage.com/' was loaded over HTTPS, but ran insecure content from 'http://www.externalpage.com': this content should also be loaded over HTTPS.

The reported line where the error occurred is in the content script where I'm issuing the HTTP call:

xhr.send(null);

I have no control over the external page and I would rather not remove SSL from our own page. Question: Is this a bug or is there a workaround that I am not aware of?

(Note: The permissions in the manifest were always set to <all_urls> which had worked for a long time. Setting it to http://*/ and https://*/ did not help.)

Solution 1:

If possible, use the https version of that external page.

If that is not possible, use the background page to handle the AJAX request (example).