Conversation
…ootstrap hints With a cross-origin assetPrefix that only returns ACAO when Origin is set, a preload fetched without CORS caches a non-CORS response and the later CORS module or stylesheet fetch fails. Fixes cloudflare#3326
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3326.
With a cross-origin
assetPrefix(e.g. R2/CDN) that only returns ACAO whenOriginis set, a preload fetched without CORS caches a non-CORS response; the later CORS module or stylesheet fetch then fails and the boundary errors.Changes
DynamicPreloadChunks: stylesheet links now carry anonymouscrossOrigin(JSmodulepreloadalready had it). Keeps the intentional no-as="style"divergence.app-ssr-entry.ts: same CORS-cache class fixed in the bootstrap hints —preinitModule(appBootstrapPreinitModules)passescrossOrigin: "", the manual bootstrapmodulepreloadlink emitscrossorigin="", and React'sbootstrapModulesis now passed as{ src, crossOrigin: "" }descriptors so both its preload link and script tag carry CORS.crossoriginassertions for same-origin CSS,/cdnpath-prefix JS, and absolute-https://cdn.example.com(every CDN modulepreload/stylesheet hint plus the dynamic stylesheet path).Same-origin behavior is unchanged (anonymous CORS is a no-op there) and nonce/CSP paths are untouched — covered by the existing nonce assertions in the same tests.
Validation
pnpm run checkgreen (fmt, lint, types, shim-type sync)tests/app-router-production-server.test.ts: 16 dynamic tests + both assetPrefix tests passtests/asset-prefix.test.ts(47),use-client-page-pathname(11),script-head-ordering(8) passNote: #3314 touches adjacent lines in
dynamic-preload-chunks.tsx(CSS dedup); happy to rebase whichever lands second — the changes compose.