From d88831b7192de728351e31433bfa5cdc6775b8ce Mon Sep 17 00:00:00 2001
From: Steve Repsher <steverep@users.noreply.github.com>
Date: Mon, 16 Oct 2023 14:40:15 -0400
Subject: [PATCH] Enable CORS for legacy bundle loading (#18248)

---
 build-scripts/webpack.cjs       | 1 +
 src/html/_js_base.html.template | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/build-scripts/webpack.cjs b/build-scripts/webpack.cjs
index 5997e59d58..985036313a 100644
--- a/build-scripts/webpack.cjs
+++ b/build-scripts/webpack.cjs
@@ -194,6 +194,7 @@ const createWebpackConfig = ({
         isProdBuild && !isStatsBuild ? "[id]-[contenthash].js" : "[name].js",
       assetModuleFilename:
         isProdBuild && !isStatsBuild ? "[id]-[contenthash][ext]" : "[id][ext]",
+      crossOriginLoading: "use-credentials",
       hashFunction: "xxhash64",
       hashDigest: "base64url",
       hashDigestLength: 11, // full length of 64 bit base64url
diff --git a/src/html/_js_base.html.template b/src/html/_js_base.html.template
index 06ae256045..9ad8a1c387 100644
--- a/src/html/_js_base.html.template
+++ b/src/html/_js_base.html.template
@@ -1,8 +1,9 @@
 <script>
-  function _ls(src, sync) {
+  function _ls(src, notCustom) {
     var script = document.createElement("script");
-    if (sync) {
+    if (notCustom) {
       script.async = false;
+      script.crossOrigin = "use-credentials";
     }
     script.src = src;
     return document.head.appendChild(script);