Add explicit "crossorigin" attribute to bundle script tag in bootstrap (

#7124)
vaadin · Dec 13, 2019 · 9fe7fa8 · 9fe7fa8
1 parent 53abdfd
commit 9fe7fa8
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 5 deletions.
diff --git a/flow-server/src/main/java/com/vaadin/flow/server/BootstrapHandler.java b/flow-server/src/main/java/com/vaadin/flow/server/BootstrapHandler.java
@@ -893,9 +893,11 @@ private void appendNpmBundle(Element head, VaadinService service,
                     Element script = createJavaScriptElement(
                             "./" + VAADIN_MAPPING + chunks.getString(key),
                             false);
-                    head.appendChild(
-                            script.attr("type", "module").attr("data-app-id",
-                                    context.getUI().getInternals().getAppId()));
+                    head.appendChild(script.attr("type", "module")
+                            .attr("data-app-id",
+                                    context.getUI().getInternals().getAppId())
+                            // Fixes basic auth in Safari #6560
+                            .attr("crossorigin", true));
                 }
             }
         }

diff --git a/flow-server/src/test/java/com/vaadin/flow/server/BootstrapHandlerTest.java b/flow-server/src/test/java/com/vaadin/flow/server/BootstrapHandlerTest.java
@@ -1097,14 +1097,14 @@ public void index_appended_to_head_in_npm()
                                         + "build/webcomponentsjs/webcomponents-loader.js\"></script>")));
 
         Assert.assertTrue(
-                "index.js should be added to head for ES6 browsers. (type module)",
+                "index.js should be added to head for ES6 browsers. (type module with crossorigin)",
                 allElements.stream().map(Object::toString)
                         .anyMatch(element -> element
                                 .equals("<script type=\"module\" src=\"./"
                                         + VAADIN_MAPPING
                                         + "build/index-1111.cache.js\" data-app-id=\""
                                         + testUI.getInternals().getAppId()
-                                        + "\"></script>")));
+                                        + "\" crossorigin></script>")));
 
         Assert.assertTrue(
                 "index.js should be added to head for ES5 browsers. (deferred and nomodule)",