Forcing crossOrigin for same-origin request in LoadScriptRuntimeModule

[jjamid]

I have encountered a bug in angular when running inside an Android WebView.

After investigating I found out the scripts with type="module" do not send credentials by default, even for the same origin. This naturally breaks the angular application since the scripts fail to load.

There is a build option that forces adding the crossOrigin for the initial scripts, however, this doesn't work for lazy loaded scripts.

The answer I got from the Angular team is that it cannot be done because it is a webpack mechanism. Following is the final answer, followed by a link to the issue.

Angular Team Answer:
This is not actionable from our end as that is how Webpack handles crossOrigin.

webpack/lib/runtime/LoadScriptRuntimeModule.js

Lines 89 to 96 in c181294

	crossOriginLoading
	? Template.asString([
	"if (script.src.indexOf(window.location.origin + '/') !== 0) {",
	Template.indent(
	`script.crossOrigin = ${JSON.stringify(crossOriginLoading)};`
	),
	"}"
	])

Issue:
angular/angular-cli#22942 (comment)

Does anyone know how this can be achieved ?
For WebView to work a crossOrigin must be added for type="module" scripts, even inside the same origin.

Right now I manually edit the runtime.js file after creation to remove the same origin check.

[vankop]

For WebView to work a crossOrigin must be added for type="module" scripts, even inside the same origin.

hm.. does not sounds right.. maybe you mean that you always need credentials?

[jjamid]

Yes. I am talking about the credentials problem. I explained that in the beginning. Credentials are not sent unless crossOrigin is present, even for same origin.

After investigating I found out the scripts with type="module" do not send credentials by default, even for the same origin. This naturally breaks the angular application since the scripts fail to load.

[jjamid]

And here is an article about similar issues
https://jakearchibald.com/2017/es-modules-in-browsers/#no-credentials

[sokra]

This naturally breaks the angular application since the scripts fail to load.

Why does that break it? Why does it need credentials to load a static file correctly?

But after all this sounds like a bug in Android WebView, since the spec says same origin module scripts should send credentials by default...

[jjamid]

It needs credentials because the application is behind credentials, including its static files...
I know that it is a WebView bug but an option in webpack might give a better workaround than manually removing the check from runtime.js
Any ideas ?