Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://github.com/webpack/webpack/issues/6972 below:

Async chunk loading fails on Safari when cookies are required to load assets · Issue #6972 · webpack/webpack · GitHub

Do you want to request a feature or report a bug?

Bug

What is the current behavior?

Loading of async chunks fails in Safari when cookies are required to load them.

There's an outstanding bug in Safari where (in violation of the spec) it doesn't send cookies for script tags with crossorigin="anonymous" attributes, even when the source url is same-origin. See the below issues for more details:

https://bugs.webkit.org/show_bug.cgi?id=171566
https://bugs.webkit.org/show_bug.cgi?id=171550

This is notable because, by default, webpack always uses crossorigin="anonymous" for all async loading of chunks, regardless of origin. This means that if cookies are required to load chunks (e.g. the app is behind an authentication layer) then chunk loading will fail in Safari.

If the current behavior is a bug, please provide the steps to reproduce.

1. Use import() to produce an async chunk
2. Serve assets from the same origin, but in a way that requires cookies to be sent for requests to the JS assets
3. Open the app in Safari

What is the expected behavior?

The async chunks should load, but they do not (because Safari doesn't currently conform to the spec and erroneously omits cookies for same-origin requests when a crossorigin attribute is set).

Admittedly this is somewhat of an edge case, but I would expect this to work by default in Webpack by default (i.e. webpack should account for the bug in Safari). At the very least, it would be nice if a workaround was documented and isn't a big burden to set up.

I see a couple potential paths forward:

• Check if the script src is actually cross-origin before setting the crossorigin attribute. I think this can be inferred from window.location and/or if the script source is a relative path.
• Document that crossOriginLoading must be set to false if assets require cookies and Safari is supported. However, I think this is a much worse option as the webpack public path can be changed at runtime.

Right now this can be fixed with a plugin (something akin to https://github.com/fusionjs/fusion-cli/blob/104a4c60596f61dbeabe59850ddb8c8bdbcad1a6/build/crossorigin-auto-attribute-plugin.js) but it would be nice if some solution was built-in.

Figured I'd open an issue because it seems nobody has reported this yet and it affects all versions of webpack that use crossorigin attributes for async chunk loading. Cheers!

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4