From 517da90abe1dddbbffd0f8683f0c06bbec7a6390 Mon Sep 17 00:00:00 2001
From: Peter Kuhmann <info@peter-kuhmann.de>
Date: Mon, 16 Sep 2024 14:55:56 +0200
Subject: [PATCH] Add `Access-Control-Allow-Origin` header with value `*` to
 tracker script asset and all its alternative paths.

---
 next.config.js | 63 +++++++++++++++++++++++++++++++++-----------------
 1 file changed, 42 insertions(+), 21 deletions(-)

diff --git a/next.config.js b/next.config.js
index b610eb2c83..87a2355416 100644
--- a/next.config.js
+++ b/next.config.js
@@ -24,7 +24,7 @@ const contentSecurityPolicy = [
   `frame-ancestors 'self' ${frameAncestors}`,
 ];
 
-const headers = [
+const defaultHeaders = [
   {
     key: 'X-DNS-Prefetch-Control',
     value: 'on',
@@ -39,12 +39,30 @@ const headers = [
 ];
 
 if (forceSSL) {
-  headers.push({
+  defaultHeaders.push({
     key: 'Strict-Transport-Security',
     value: 'max-age=63072000; includeSubDomains; preload',
   });
 }
 
+const trackerHeaders = [
+  {
+    key: 'Access-Control-Allow-Origin',
+    value: '*',
+  },
+];
+
+const headers = [
+  {
+    source: '/:path*',
+    headers: defaultHeaders,
+  },
+  {
+    source: '/script.js',
+    headers: trackerHeaders,
+  },
+];
+
 const rewrites = [];
 
 if (collectApiEndpoint) {
@@ -54,19 +72,6 @@ if (collectApiEndpoint) {
   });
 }
 
-if (trackerScriptName) {
-  const names = trackerScriptName?.split(',').map(name => name.trim());
-
-  if (names) {
-    names.forEach(name => {
-      rewrites.push({
-        source: `/${name.replace(/^\/+/, '')}`,
-        destination: '/script.js',
-      });
-    });
-  }
-}
-
 const redirects = [
   {
     source: '/settings',
@@ -85,6 +90,27 @@ const redirects = [
   },
 ];
 
+// Adding rewrites + headers for all alternative tracker script names.
+if (trackerScriptName) {
+  const names = trackerScriptName?.split(',').map(name => name.trim());
+
+  if (names) {
+    names.forEach(name => {
+      const normalizedSource = `/${name.replace(/^\/+/, '')}`;
+
+      rewrites.push({
+        source: normalizedSource,
+        destination: '/script.js',
+      });
+
+      headers.push({
+        source: normalizedSource,
+        headers: trackerHeaders,
+      });
+    });
+  }
+}
+
 if (cloudMode && cloudUrl) {
   redirects.push({
     source: '/settings/:path*',
@@ -153,12 +179,7 @@ const config = {
     return config;
   },
   async headers() {
-    return [
-      {
-        source: '/:path*',
-        headers,
-      },
-    ];
+    return headers;
   },
   async rewrites() {
     return [