Relax CORS restrictions for module imports

[yesil]

Milo consumers CC/DC are already running
without strict CORS restriction.
This change will enable the feature in PR#2544
to be used on Milo pages as well.

For more context, see: #2544 (comment)

Resolves: MWPW-153962

Test URLs:

• Before: https://main--milo--adobecom.hlx.page/?martech=off
• After: https://mwpw-153962-2--milo--yesil.hlx.page/?martech=off

[aem-code-sync]

Page	Scores	Audits	Google
/?martech=off

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 95.82%. Comparing base (c896518) to head (bd885a6).

Additional details and impacted files

@@            Coverage Diff             @@
##            stage    #2549      +/-   ##
==========================================
- Coverage   95.83%   95.82%   -0.01%     
==========================================
  Files         176      176              
  Lines       46122    46122              
==========================================
- Hits        44199    44195       -4     
- Misses       1923     1927       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[yesil]

Closing for now, will re-open if needed.

[yesil]

re-opening for the following reason:

Given:
Milo: https://mwpw-153962--milo--yesil.hlx.live/drafts/ilyas/checkout-links?maslibs=main
CC: https://main--cc--adobecom.hlx.live/products/catalog?milolibs=mwpw-153962--milo--yesil&maslibs=main

Milo one fails with the following error:

checkout-links:1 Access to script at 'https://main--mas--adobecom.hlx.live/lib/commerce.js' from origin 'https://mwpw-153962--milo--yesil.hlx.live' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

[mokimo]

I don't have the context on why we have the flag set to begin with. However, I don't think we pass on any credentials to scripts so this should be fine to remove. 👍

Might have been legacy, as helix has seen some CORS/header changes over the years since this was implemented.

The head.html might have some restrictions in terms of caching, so it might even need some manual flushing of the cache - but we will see.

[mokimo]

@auniverseaway confirmed on slack that this only exists for legacy reasons and should be removed. It simply wasn't done so far, as it wasn't affecting anyone.

[yesil]

@afmicka this is not affected to commerce, but can you perform a smoke test to validate? Thanks.

[milo-pr-merge]

Skipped merging 2549: Relax CORS restrictions for module imports due to failing checks

[afmicka]

@yesil @npeltier @overmyheadandbody @narcis-radu it says that it skipped merging due to the failed checks. Do you know what failing checks? The last commit is green.

[mokimo]

@afmicka I dug into this and this is very weird. Seems like the same test ran twice at the same time, with one finishing 4 seconds after the other one and failing. Usually, the LASTEST test run is accounted for, so our milo_pr_merge bot is indeed more correct than the UI.

    {
      id: 27332787302,
      name: 'Running E2E & IT',
      status: 'completed',
      conclusion: 'success',
      started_at: '2024-07-11T15:57:43Z',
      completed_at: '2024-07-11T16:02:02Z',
      ...
    },

    {
      id: 27332787513,
      name: 'Running E2E & IT',
      status: 'completed',
      conclusion: 'failure',
      started_at: '2024-07-11T15:57:43Z',
      completed_at: '2024-07-11T16:02:06Z',
    },

So after this I re-ran the nala tests and now they are properly failing

[afmicka]

Thanks @mokimo. These are now new failures, started in the last hour. They have not been here yesterday in any of the PRs, nor today during European day. Our changes do not affect marketo test pages and are failing in all pur new PRs. Will check