From 85918cab9f6f360984d38d140473eab5f29fead6 Mon Sep 17 00:00:00 2001
From: Michael Wenzel <wenzel@uber.com>
Date: Sun, 21 Apr 2019 21:57:34 -0400
Subject: [PATCH] hardcode crossorigin script attribute

---
 plugins/ssr-plugin.js               |  6 ++---
 test/e2e/dynamic-import-app/test.js | 37 +++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 3 deletions(-)

diff --git a/plugins/ssr-plugin.js b/plugins/ssr-plugin.js
index b08c2348..df8431fa 100644
--- a/plugins/ssr-plugin.js
+++ b/plugins/ssr-plugin.js
@@ -113,9 +113,9 @@ const SSRBodyTemplate = createPlugin/*:: <SSRBodyTemplateDepsType,SSRBodyTemplat
         let preloadHints = [];
 
         for (let url of criticalChunkUrls) {
-          const crossoriginAttr = url.startsWith(__webpack_public_path__)
-            ? ''
-            : ' crossorigin="anonymous"';
+          const crossoriginAttr = process.env.CDN_URL
+            ? ' crossorigin="anonymous"'
+            : '';
           preloadHints.push(
             `<link rel="preload" href="${url}" nonce="${
               ctx.nonce
diff --git a/test/e2e/dynamic-import-app/test.js b/test/e2e/dynamic-import-app/test.js
index c33a3602..4cc5620a 100644
--- a/test/e2e/dynamic-import-app/test.js
+++ b/test/e2e/dynamic-import-app/test.js
@@ -215,6 +215,43 @@ test('`fusion build` app with dynamic imports integration', async () => {
   proxy.close();
 }, 100000);
 
+test('`fusion build` app with CDN_URL and same-origin', async () => {
+  await cmd(`build --dir=${dir} --production`);
+
+  // Run puppeteer test to ensure that page loads with dynamic content.
+  const {proc, port} = await start(`--dir=${dir}`, {
+    env: Object.assign({}, process.env, {
+      CDN_URL: 'https://cdn.com/test',
+      NODE_ENV: 'production',
+    }),
+  });
+
+  const browser = await puppeteer.launch({
+    args: ['--no-sandbox', '--disable-setuid-sandbox'],
+    headless: true,
+  });
+  const page = await browser.newPage();
+  await page.setRequestInterception(true);
+  await page.on('request', request => {
+    if (request.url().startsWith('https://cdn.com')) {
+      request.abort();
+    } else {
+      request.continue();
+    }
+  });
+  await page.goto(`http://localhost:${port}/`, {waitUntil: 'load'});
+
+  t.ok(
+    await page.$$eval('script[src]:not([type="application/json"])', els =>
+      els.every(el => el.crossOrigin === 'anonymous')
+    ),
+    'non-module scripts have crossorigin attribute'
+  );
+
+  browser.close();
+  proc.kill();
+}, 100000);
+
 test('`fusion build` app with Safari user agent and same-origin', async () => {
   var env = Object.create(process.env);
   env.NODE_ENV = 'production';