fix(next-export): CORS errors due to wrong `crossorigin` default value

[ild0tt0re]

If corsOrigin is not specified in nextConfig it become false and in the following code

crossOrigin: nextConfig.crossOrigin || '',

It fallback to empty string '' , but this is wrong since the default value should be undefined otherwise we are forcing the client to use ALWAYS CORS for assets as you can see from the MDN Official crossorigin spec

some crossorigin values can be:

• anonymous: Request uses CORS headers and credentials flag is set to 'same-origin'. There is no exchange of user credentials via cookies, client-side TLS certificates or HTTP authentication, unless destination is the same origin.
• "": Setting the attribute name to an empty value, like crossorigin or crossorigin="", is the same as anonymous.

By default (that is, when the attribute is not specified), CORS is not used at all. The user agent will not ask for permission for full access to the resource and in the case of a cross-origin request, certain limitations will be applied based on the type of element concerned:

You can see the Current vs. Expected behavior in the issue

Fixes #57931

[kyun]

Is this still working on?

[stepan-twnty]

@ijjk can you approve it?

[dgattey]

Any updates on this fix? This fixes a critical bug still present in Next 14.1 with CORS attributes being incorrectly required

[samithaf]

@leerob could you please review?

[Xavier59]

Can we just merge it and add regression test later @ijjk ? Everybody using CDN to serve content has been stuck on 13.5.2 for months. Thanks

[konstk1]

Is this abandoned? We are also having an issue with crossorigin scripts.

[samithaf]

While it may not be a solution for everyone, we solved this issue by fronting the Next.js applications with a CDN and then route the static assets to a static storage (Azure Blobs but can be anything depend on which cloud provider you are using). Then we route dynamic paths to web compute tier via CDN.

Given static paths going to be relative now, you are not going to face any CORS issues anymore.

[willholmeswastaken]

Suffering from this issue myself too... hopefully we get some answers on this soon.

[akbortoli]

Is this abandoned? We are having to patch every version for it to work via CDN.

[Xavier59]

Hello @ijjk please review again for merge. Lot of people suffering from this issue and there is no update.