hardcode crossorigin script attribute

plugins/ssr-plugin.js

@@ -113,9 +113,9 @@ const SSRBodyTemplate = createPlugin/*:: <SSRBodyTemplateDepsType,SSRBodyTemplat
         let preloadHints = [];
 
         for (let url of criticalChunkUrls) {
-          const crossoriginAttr = url.startsWith(__webpack_public_path__)
-            ? ''
-            : ' crossorigin="anonymous"';
+          const crossoriginAttr = process.env.CDN_URL
+            ? ' crossorigin="anonymous"'
+            : '';
           preloadHints.push(
             `<link rel="preload" href="${url}" nonce="${
               ctx.nonce

test/e2e/dynamic-import-app/test.js

@@ -215,6 +215,43 @@ test('`fusion build` app with dynamic imports integration', async () => {
   proxy.close();
 }, 100000);
 
+test('`fusion build` app with CDN_URL and same-origin', async () => {
+  await cmd(`build --dir=${dir} --production`);
+
+  // Run puppeteer test to ensure that page loads with dynamic content.
+  const {proc, port} = await start(`--dir=${dir}`, {
+    env: Object.assign({}, process.env, {
+      CDN_URL: 'https://cdn.com/test',
+      NODE_ENV: 'production',
+    }),
+  });
+
+  const browser = await puppeteer.launch({
+    args: ['--no-sandbox', '--disable-setuid-sandbox'],
+    headless: true,
+  });
+  const page = await browser.newPage();
+  await page.setRequestInterception(true);
+  await page.on('request', request => {
+    if (request.url().startsWith('https://cdn.com')) {
+      request.abort();
+    } else {
+      request.continue();
+    }
+  });
+  await page.goto(`http://localhost:${port}/`, {waitUntil: 'load'});
+
+  t.ok(
+    await page.$$eval('script[src]:not([type="application/json"])', els =>
+      els.every(el => el.crossOrigin === 'anonymous')
+    ),
+    'non-module scripts have crossorigin attribute'
+  );
+
+  browser.close();
+  proc.kill();
+}, 100000);
+
 test('`fusion build` app with Safari user agent and same-origin', async () => {
   var env = Object.create(process.env);
   env.NODE_ENV = 'production';