From 10e27370999ac3c914913710be2b95b87d9f7113 Mon Sep 17 00:00:00 2001 From: Xan Torres Date: Tue, 4 Aug 2026 18:07:29 +0800 Subject: [PATCH 1/2] docs: note the CORS requirement for CDN-served assets --- docs/getting-started/upgrade.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/getting-started/upgrade.md b/docs/getting-started/upgrade.md index 44f3a42b1..d0d3b2d6d 100644 --- a/docs/getting-started/upgrade.md +++ b/docs/getting-started/upgrade.md @@ -57,3 +57,11 @@ If you are using a binary installation of answer, the upgrade steps are as follo When there are other unexpected cases such as upgrade exceptions, we provide a command to manually force the upgrade of Apache Answer. `answer upgrade -f v1.1.0` Executing this command will force upgrade from the specified version, even if your Apache Answer is already up to date. If you encounter an upgrade exception, you can try to execute this command or pull the latest docker image again and execute this command inside the container. ::: + +:::caution + +Starting with the release that migrates the frontend build to Vite, the frontend loads as ES modules instead of classic scripts. Same-origin deployments, where Answer serves its own static assets, need no changes. + +If your deployment serves static assets from a separate CDN origin, for example through the `cdn-aliyun` or `cdn-s3` plugin, the CDN must send an `Access-Control-Allow-Origin` header matching your site's origin. A module script is always fetched in CORS mode, so without that header the browser refuses to run it and the page loads with no JavaScript, even though the request for the file itself succeeds. See the CDN plugin's README for a concrete CORS rule for that provider. + +::: From aab64e061b609c8506bd889fc6d3cd42f3766608 Mon Sep 17 00:00:00 2001 From: Xan Torres Date: Tue, 4 Aug 2026 19:22:11 +0800 Subject: [PATCH 2/2] docs: anchor the CORS note to its source and define origin --- docs/getting-started/upgrade.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/getting-started/upgrade.md b/docs/getting-started/upgrade.md index d0d3b2d6d..81c8c55e9 100644 --- a/docs/getting-started/upgrade.md +++ b/docs/getting-started/upgrade.md @@ -60,8 +60,8 @@ When there are other unexpected cases such as upgrade exceptions, we provide a c :::caution -Starting with the release that migrates the frontend build to Vite, the frontend loads as ES modules instead of classic scripts. Same-origin deployments, where Answer serves its own static assets, need no changes. +Starting with the release that includes the frontend migration to Vite ([apache/answer#1567](https://github.com/apache/answer/pull/1567)), the frontend loads as ES modules instead of classic scripts. Same-origin deployments, where Answer serves its own static assets, need no changes. -If your deployment serves static assets from a separate CDN origin, for example through the `cdn-aliyun` or `cdn-s3` plugin, the CDN must send an `Access-Control-Allow-Origin` header matching your site's origin. A module script is always fetched in CORS mode, so without that header the browser refuses to run it and the page loads with no JavaScript, even though the request for the file itself succeeds. See the CDN plugin's README for a concrete CORS rule for that provider. +If your deployment serves static assets from a separate CDN origin, for example through the `cdn-aliyun` or `cdn-s3` plugin, the CDN must send an `Access-Control-Allow-Origin` header matching your site's origin (scheme, host, and port, for example `https://example.com`). A module script is always fetched in CORS mode, so without that header the browser refuses to run it and the page loads with no JavaScript, even though the request for the file itself succeeds. See the CDN plugin's README for a concrete CORS rule for that provider. :::