CORS error referencing JavaScript files

Using this method to upload a Javascript file

But then, when I try to reference it from the Squarespace site, I get a CORS error:

Am I doing something wrong here?

Hi. I'm having this exact same issue-- both with Javascript files and trying to refer to a json file.   Were you able to find a solution?

I found a way to deal with it-- I put .js and .json files in a s3 bucket and turned out a CORS policy on the s3 bucket.

There's a fix that @dmitrykiselyov has used a few times as a way to give the browser what it needs.
I'll let him share it here if he chooses to. (He can also explain it better than me!) 

Hi @popsovy,

Try this path /s/runtime-es2015.js

<script src="/s/runtime-es2015.js"></script>

That's presumably what @popsovy was already doing, as it's the method used in the page he linked to. Unfortunately that doesn't work, as /s/filename.ext is loaded from static1.squarespace.com, for which Squarespace unhelpfully don't have a CORS Access-Control-Allow-Origin header.

Okay, so the correct answer seems to be to use the redirect URL (e.g. https://static1.squarespace.com/static/57014b5b746fb963478e3d4f/t/5d7ba83d4e25b616833d896b/1568385085375/runtime-es2015.js in @popsovy's case), not the path that @dmitrykiselyov mentioned.

How does one get/find the static1.squarespace.com URL @MattB2? Whenever I put in the domain.com/s/script.js URL into my browser, for example, it just automatically downloads the script file. Doesn't actually show where the redirect URL is.

Hi @popsovy - did you resolve this? 

Ccing you as well @MattB2

I am trying to use d3.csv to access a file I have uploaded as a link and whatever I get a 404 with the filename and a CORS with /s/ + filename or the full https static1.squarespace link...  Confused!

On 8/25/2020 at 8:49 PM, salondaome said:

How does one get/find the static1.squarespace.com URL @MattB2? Whenever I put in the domain.com/s/script.js URL into my browser, for example, it just automatically downloads the script file. Doesn't actually show where the redirect URL is.

In the "Custom CSS" area, there's a control to allow uploading "Custom Files" (font files). When uploaded this way, the CORS headers are set correctly, automatically. Clicking on an uploaded file automatically inserts the file's path in your custom css, but you need to check where the path is inserted.