Blocked by CORS on Safari : Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.

[poof86]

Loading the packages works fine on Chrome but in Safari i'm getting these errors:

Is it something I'm doing wrong or has the CORS on esm.sh changed?
Do I need to use a proxy solution if I want it to work for Safari and it's stricter CORS?

Thanks!

[ije]

seems it works for me. can you please share your code?
read this may can help: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials

[poof86]

I'm using an importmap and have my modules loaded in the header like this:

<script type="importmap" id="wp-importmap">
{"imports":{"@floating-ui\/dom":"https:\/\/esm.sh\/@floating-ui\/dom?alias=react:preact\/compat,react-dom:preact\/compat,react\/jsx-runtime:preact\/jsx-runtime,@types\/react:preact\/compat\[email protected]","fuse.js":"https:\/\/esm.sh\/fuse.js"}}
</script>
<script type="module" src="https://domain.com/js/view.js?ver=c8b1f7a1c16e1b41" id="view-script-module-js-module" crossorigin="anonymous"></script>

I've added the crossorigin attribute, but that didn't seem to help...

[ije]

can you please check whether safari tries to send cookies to esm.sh?

[poof86]

In the Safari Inspector Network tab I see this for the request:

Request Cookies
No request cookies.

Response Cookies
No response cookies.

Also, when I enable in Safari -> Settings... > Developer Tab > "Disable cross-origin restrictions" all works fine like in Chrome

So some of the requests get a redirect and Safari is not happy with that

Failed to load resource: Cross-origin redirection to https://esm.sh/[email protected]?exports=Decimal denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.

Is there a way to disable crossorigin credentials for all import requests that are done through an importmap?

[poof86]

I'm trying out self-hosting esm.sh to come with a solution.

In my NGINX reverse proxy to the esm.sh docker I'm replacing the 'Access-Control-Allow-Origin' header to not use a wildcard "*" value but use the specific $http_origin with a map of origins I will allow. It seems to work for now, luckily esm.sh has this self hosting feature!