Stencil: Crossorigin "True" on Scripts Prevents Sending Auth

[lupiter]

[ Reopening closed issue #1076 ]

I'm submitting a:

[ ] bug report
[X] feature request
[ ] support request => Please do not submit support requests here, use one of these channels: https://stencil-worldwide.herokuapp.com/ or https://forum.ionicframework.com/

Current behavior:
Currently the loader sets "crossorigin" to be "true" (interpreted as "anonymous", not sure why it isn't set explicitly to that). This means that those files can't be hosted on a server requesting auth, for example if the entire Stencil page is behind a proxy that checks for cookies, no cookies will be sent with the request. This property was briefly set to "use-credentials" in 0.8.1, and reverted back in 0.8.2 (with the slightly cryptic message "fixes CORS issue in unpkg").

Expected behavior:
I would expect that for a dist build, "crossorigin" would be "anonymous" and for a www build "crossorigin" would be set to "use-credentials" or unset.

If there are cases I haven't thought of, please let me know. I'd also be happy with a config option to change the value.

slack thread

[tavikukko]

Got the same problem and would love to have an option in config to override the crossOrigin value. Currently we are manually changing that value in @stencil/core/dist/client/loader.js

[jensgustafsson]

This is still an issue in stencil one. In stencil 0.x I fixed it by manually setting crossorigin to set-credentials or anonymous.

Btw, this is an issue in Safari. It seems like it works in all other browsers

[ckrack]

We are having this issue in Stencil One, too.
Not in all browsers, but Firefox 60 ESR is affected.

[axlwaii]

We need this too.

[adamdbradley]

This specific issue should have been fixed from the 1.0.0 release, and the Firefox 60 ESR and Edge fix should be in as of 1.8.3: https://github.com/ionic-team/stencil/commit/7c45767321af89c54c2cc9433b49828c25fd12d8

Thanks