fix: only simulate CORS errors with HTTP URLs

.changeset/forty-crabs-hang.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+fix: avoid simulated CORS errors with non-HTTP URLs

packages/kit/src/runtime/server/page/load_data.js

@@ -242,7 +242,7 @@ export function create_universal_fetch(event, state, fetched, csr, resolve_opts)
 				dependency = { response, body: null };
 				state.prerendering.dependencies.set(url.pathname, dependency);
 			}
-		} else {
+		} else if (url.protocol === 'https:' || url.protocol === 'http:') {
 			// simulate CORS errors and "no access to body in no-cors mode" server-side for consistency with client-side behaviour
 			const mode = input instanceof Request ? input.mode : (init?.mode ?? 'cors');
 			if (mode === 'no-cors') {

packages/kit/src/runtime/server/page/load_data.spec.js

@@ -58,6 +58,13 @@ test('errors when no acao header present on cors', async () => {
 	);
 });
 
+test('succeeds when fetching from local scheme', async () => {
+	const fetch = create_fetch({});
+	const response = await fetch('data:text/plain;foo');
+	const text = await response.text();
+	assert.equal(text, 'foo');
+});
+
 test('errors when trying to access non-serialized request headers on the server', async () => {
 	const fetch = create_fetch({});
 	const response = await fetch('https://domain-a.com');