I'm looking at a site (https://www.somestore.com) where an XHR/ajax request to http://www.somestore.com is getting blocked by the Content Security Policy. Note that the site operates under HTTPS and the ajax request is over HTTP.

This site's CSP policy lists self and the store's domain name without the protocol type:

connect-src 'self' www.somestore.com

Chrome is reporting

Refused to connect to 'http://www.somestore.com/...' because it violates the following Content Security Policy directive: "connect-src 'self' www.somestore.com.

I don't access to the server to run tests, but at a glance, it seems that the directive should not interfere with the ajax request, but CSP seems to distinguishes between HTTP and HTTPS and treat them as different origins. I could not find any info regarding this online.

My hunch is that www.somestore.com can be removed from the directive and the ajax should be changed to HTTPS, and this problem would go away. Any idea?