title: <script crossorigin>, why got 'blocked by CORS' error?
body: <p>recently, i added the crossorigin attribute to script element to solve the mutted exception problem. but i found a strange problem, if the response header doesn't set correct access-control-allow-origin, then i get a cross origin error and the script will not execute.</p>
  
  <p>here is the code:</p>
  
  <pre><code>&lt;script src = 'https://blog.sentry.io/js/script.js' crossorigin&gt;&lt;/script&gt;
  </code></pre>
  
  <p>this is the error message:</p>
  
  <blockquote>
    <p>Script from origin '<a href="https://blog.sentry.io" rel="nofollow noreferrer">https://blog.sentry.io</a>' has been blocked from
    loading by Cross-Origin Resource Sharing policy: No
    'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin 'null' is therefore not allowed access.</p>
  </blockquote>
  
  <p>this is the request header:</p>
  
  <pre><code>GET /js/script.js HTTP/1.1
  Host: blog.sentry.io
  Connection: keep-alive
  Pragma: no-cache
  Cache-Control: no-cache
  Accept: */*
  Origin: null
  User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_0 like Mac OS X)     AppleWebKit/600.1.3 (KHTML, like Gecko) Version/8.0 Mobile/12A4345d   Safari/600.1.4
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,ja;q=0.4
  Cookie: ajs_anonymous_id=%22d6975e43-f4d3-4d98-a74e-5b319594902a%22; ajs_user_id=null; ajs_group_id=null; _ga=GA1.2.141680712.1484118184; __ar_v4=HBLTKULO45CAHNTTTEO3IG%3A20170110%3A2%7C7M3QZV2OWJGMBAGSKP2TG5%3A20170110%3A2%7CMLWCNCFTMJGD7GPDGE6RVT%3A20170110%3A2
  </code></pre>
  
  <p>this is the response header:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Server: nginx
  Date: Thu, 02 Feb 2017 10:50:40 GMT
  Content-Type: application/javascript; charset=utf-8
  Content-Length: 35758
  Connection: close
  Last-Modified: Thu, 26 Jan 2017 18:37:33 GMT
  Expires: Tue, 31 Jan 2017 05:01:26 GMT
  Cache-Control: max-age=600
  Content-Encoding: gzip
  Accept-Ranges: bytes
  X-Timer: S1486032640.581431,VS0,VE0
  Vary: Accept-Encoding
  Strict-Transport-Security: max-age=31536000
  X-Frame-Options: SAMEORIGIN
  </code></pre>
  
  <p>i try to find answer in the whatwg specification, and the specification says:</p>
  
  <blockquote>
    <p>The crossorigin attribute is a CORS settings attribute. For classic scripts, it controls whether error information will be exposed, when the script is obtained from other origins. For module scripts, it controls the credentials mode used for cross-origin requests.</p>
    
    <p>Unlike classic scripts, module scripts require the use of the CORS protocol for cross-origin fetching.</p>
  </blockquote>
  
  <p>so i think crossorigin attribute should only control the error information, not the execution of script.</p>
  
  <p>what causes this problem? and what can i do to fix this problem now?</p>