# CDN assets support access-control-allow-origin: \*

**URL:** <https://community.apollographql.com/t/cdn-assets-support-access-control-allow-origin/5894>\
**Category:** GraphOS\
**Tags:** server, web, studio\
**Created:** [March 7, 2023, 3:53pm UTC](https://community.apollographql.com/t/cdn-assets-support-access-control-allow-origin/5894 "2023-03-07T15:53:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ergofriend](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/ergofriend/32/4016_2.png) [@ergofriend](https://community.apollographql.com/u/ergofriend)\
**Post date:** [March 7, 2023, 3:53pm UTC](https://community.apollographql.com/t/cdn-assets-support-access-control-allow-origin/5894/1 "2023-03-07T15:53:27Z")

</div>

I am trying to use [Apollo Sandbox](https://www.apollographql.com/docs/graphos/explorer/sandbox/#embedding-sandbox) with CDN assets.  
With [Subresource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity), fetching `embeddable-sandbox.umd.production.min.js` return CORS error. It’s like this.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/apollographql/original/2X/b/ba0e2850915f2710d93e6ccb268df281515df155.png)

```html
<script rel="preload" as="script" type="text/javascript" crossorigin="anonymous" integrity="sha256-zBwhGqKkP2HAC/cgcvud4YMRGFeYz/S9vjOBL3e9qII=" src="https://embeddable-sandbox.cdn.apollographql.com/2c39bc65f284867ec89935781959282e5605f3f6/embeddable-sandbox.umd.production.min.js"></script>

```

I think it should return with the `access-control-allow-origin: *` header.

---

<div class="post-metadata">

**Author:** ![trevor.scheer](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/trevor.scheer/32/5669_2.png) [@trevor.scheer](https://community.apollographql.com/u/trevor.scheer)\
**Post date:** [March 8, 2023, 5:48pm UTC](https://community.apollographql.com/t/cdn-assets-support-access-control-allow-origin/5894/2 "2023-03-08T17:48:45Z")

</div>

Hey @ergofriend, thanks for reporting! It looks like @cheapsteak is already working on a fix for this. We’ll follow up when it’s deployed!

---

<div class="post-metadata">

**Author:** ![Chang](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/chang/32/45_2.png) [@Chang](https://community.apollographql.com/u/Chang)\
**Post date:** [March 9, 2023, 4:41pm UTC](https://community.apollographql.com/t/cdn-assets-support-access-control-allow-origin/5894/3 "2023-03-09T16:41:08Z")

</div>

Hi there, the update is released and the CORS error should go away now!

A heads up though that the `_latest/` bundle would change with each deploy, and thus the integrity hash would become outdated when new bundles are released

If you do need the integrity hash, Instead of `_latest`, you could put in the full commit hash of the commit corresponding to a deploy, e.g. `https://embeddable-sandbox.cdn.apollographql.com/a7a3315471b58b65cdd4e82dec7f85006d3baf1c/embeddable-sandbox.umd.production.min.js`

You could find the list of commits here: [Commits · apollographql/embeddable-explorer · GitHub](https://github.com/apollographql/embeddable-explorer/commits/main)

---

<div class="post-metadata">

**Author:** ![Justin\_Gonzalez](https://sea1.discourse-cdn.com/flex019/user_avatar/community.apollographql.com/justin_gonzalez/32/5359_2.png) [@Justin\_Gonzalez](https://community.apollographql.com/u/Justin_Gonzalez)\
**Post date:** [February 6, 2025, 8:49pm UTC](https://community.apollographql.com/t/cdn-assets-support-access-control-allow-origin/5894/4 "2025-02-06T20:49:19Z")

</div>