Skip to content

fix: Remove invalid crossOrigin from source elements (Issue #266 deployment blocker)#268

Merged
maxrantil merged 3 commits intomasterfrom
hotfix/issue-266-typescript-fixes
Jan 18, 2026
Merged

fix: Remove invalid crossOrigin from source elements (Issue #266 deployment blocker)#268
maxrantil merged 3 commits intomasterfrom
hotfix/issue-266-typescript-fixes

Conversation

@maxrantil
Copy link
Owner

@maxrantil maxrantil commented Jan 13, 2026

Summary

Complete fix for Issue #266 OpaqueResponseBlocking errors.

The root cause had THREE parts - PR #267 only fixed one of them:

  1. Missing crossOrigin on img elements (fixed in PR fix: Add crossOrigin attribute to prevent OpaqueResponseBlocking on Sanity CDN images #267)
  2. Invalid crossOrigin on source elements (commit 73bd93d)
  3. Missing crossOrigin on preload links (commit 3e5530c) ← ROOT CAUSE

Changes

Commit 1: Session Handoff Documentation (c1c98ff)

Commit 2: Fix TypeScript Errors (73bd93d)

  • ✅ Removed invalid crossOrigin from AVIF <source> element
  • ✅ Removed invalid crossOrigin from WebP <source> element
  • ✅ Kept crossOrigin on <img> element (valid and required for CORS)
  • ✅ Fixed test mock: removed invalid _type: 'slug' from slug object
  • ✅ Updated tests to verify <source> elements don't have crossorigin

Per HTML5 spec, crossorigin is NOT valid on <source> elements. CORS policy is inherited from fallback <img> element.

Commit 3: Add crossOrigin to Image Preload Links (3e5530c)FIXES OpaqueResponseBlocking

  • ✅ Added crossOrigin="anonymous" to homepage LCP image preload (src/app/page.tsx:142)
  • ✅ Added crossOrigin="anonymous" to projects page LCP image preload (src/app/projects/page.tsx:135)
  • ✅ Matches existing pattern from font preloads (src/app/layout.tsx:67,74)

This was the missing piece! The image elements had crossOrigin, but the <link rel="preload"> tags didn't, causing the browser to block the preloaded images.

Root Cause Analysis

Production error on idaromme.dk:

OpaqueResponseBlocking: A resource is blocked by OpaqueResponseBlocking
The resource at "https://cdn.sanity.io/images/.../300a68a5...jpg?w=640&q=40&fm=avif" 
preloaded with link preload was not used within a few seconds.

Why it happened:

Why crossOrigin is required on preload links:
Per MDN, when preloading cross-origin resources that will be fetched with CORS (like images from cdn.sanity.io), the preload link MUST have matching crossorigin attribute. Otherwise, the preloaded resource is treated as a separate request and not reused.

Testing

Type Check: Passes without errors
All Unit Tests: 938 passed (938/961 total, 23 skipped)
FirstImage Tests: 17/17 passed including CORS security tests
Production Build: Successful
Pre-commit Hooks: All passed

Deployment Impact

This hotfix completely fixes Issue #266:

  1. ✅ Images have proper CORS attributes
  2. ✅ No TypeScript errors blocking CI
  3. ✅ Preload links properly configured
  4. ✅ OpaqueResponseBlocking errors resolved

Once merged and deployed to idaromme.dk:

  • ✅ No console errors for Sanity CDN images
  • ✅ LCP images preload correctly with CORS
  • ✅ Browser can reuse preloaded resources
  • ✅ Performance maintained (no regressions)

Related Issues

Complete session handoff documentation for Issue #266/PR #267.

Summary:
- Fixed OpaqueResponseBlocking by adding crossOrigin attribute
- TDD workflow: 8 new tests, all passing (950/950)
- Local production testing confirmed working
- PR merged to master, ready for VPS deployment

Next session: Deploy to production VPS at idaromme.dk
Per HTML5 spec, crossorigin attribute is not valid on <source> elements.
CORS policy is inherited from the fallback <img> element.

Changes:
- Remove crossOrigin from AVIF source element
- Remove crossOrigin from WebP source element
- Keep crossOrigin on img element (valid and required)
- Fix test mock to remove invalid _type from slug
- Update tests to verify source elements don't have crossorigin
@maxrantil maxrantil changed the title hotfix: Fix TypeScript errors blocking Issue #266 deployment fix: Remove invalid crossOrigin from source elements (Issue #266 deployment blocker) Jan 13, 2026
@codecov-commenter
Copy link

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@github-actions
Copy link

🔍 Lighthouse Performance Report

❌ No Lighthouse results found. Check the workflow logs for details.


This report was generated by Lighthouse CI in GitHub Actions

@github-actions
Copy link

github-actions bot commented Jan 13, 2026

🎯 Performance Budget Summary

Bundle Size Analysis

  • Status: warning
  • Total Size:
  • Budget: 1.5MB (1.45MB in CI)

Lighthouse Performance Validation

Desktop Results

  • Performance Score: Target 98%+
  • LCP: Target <1s
  • CLS: Target <0.05

Mobile Results

  • Performance Score: Target 98%+
  • LCP: Target <1s
  • CLS: Target <0.05

Performance Budget Status

  • Bundle Size: FAILED
  • Lighthouse Budget: PASSED

Next Steps

  • 🔧 Optimize bundle size to meet budget constraints

Generated at $(date)

…locking fix)

Root cause identified: Image preload links were missing crossorigin="anonymous"
attribute, causing OpaqueResponseBlocking errors in production.

Changes:
- Add crossOrigin="anonymous" to homepage LCP image preload (page.tsx:142)
- Add crossOrigin="anonymous" to projects page LCP image preload (projects/page.tsx:135)
- Matches existing pattern from font preloads (layout.tsx:67,74)

This completes the Issue #266 fix:
1. crossOrigin on img elements (PR #267) ✅
2. Remove invalid crossOrigin from source elements (commit 73bd93d) ✅
3. Add crossOrigin to preload links (this commit) ✅

Expected result: No more OpaqueResponseBlocking errors on idaromme.dk
@github-actions
Copy link

🔍 Lighthouse Performance Report

❌ No Lighthouse results found. Check the workflow logs for details.


This report was generated by Lighthouse CI in GitHub Actions

@maxrantil maxrantil merged commit 796e891 into master Jan 18, 2026
23 of 25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix: Add crossorigin attribute to prevent OpaqueResponseBlocking on Sanity CDN images

2 participants