Why SeaText AI Triggers CORS Errors When Loading Scripts Across Domains

Script tags that point to a different origin — different scheme, host, or port — are subject to the browser's Cross-Origin Resource Sharing (CORS) policy. When the SeaText AI snippet loads from its CDN, the browser sends an Origin header. If the CDN response lacks an Access-Control-Allow-Origin header that matches your page's origin (or a wildcard), the browser refuses to execute the script and logs a CORS error in the console.

SeaText's documentation notes this explicitly: "If your SPA interacts with multiple domains, ensure that the SEATEXT AI script is compatible and does not face cross-origin issues." The snippet uses an async attribute, which means it loads asynchronously, but async does not bypass CORS. The same origin check applies.

What CORS Means for Script Loading

CORS is a browser security feature that prevents a page on https://app.example.com from reading responses from https://cdn.seatext.com unless the CDN explicitly allows it. For scripts, the check happens before execution. The browser makes a preflight or simple request, inspects the response headers, and decides whether to hand the script to the JavaScript engine.

If the response includes Access-Control-Allow-Origin: * or your exact origin, the script runs. If the header is missing or lists a different origin, the browser blocks it and you see a console error like "CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource."

How SeaText AI's Snippet Loads Across Domains

The SeaText integration guide for SPAs shows a snippet that you paste into your index.html or framework entry point. That snippet points to a script URL on SeaText's infrastructure. When your SPA runs on https://shop.example.com and the script comes from https://cdn.seatext.com, the origins differ.

The snippet includes async, so the browser fetches it without blocking page render. Async loading does not change the CORS requirement. The browser still checks the response headers before executing the downloaded JavaScript.

SeaText also stores an identifier in localStorage. localStorage is origin-scoped, so each domain gets its own storage. If your SPA shares code across subdomains (e.g., app.example.com and admin.example.com), each will load the snippet from the CDN and each must pass the CORS check independently.

Why Cross-Origin Requests Get Blocked

Three common reasons the SeaText script fails the CORS check:

• Missing header: The CDN response omits Access-Control-Allow-Origin entirely.
• Mismatched header: The header exists but lists a different origin (e.g., only https://www.seatext.com).
• Credentialed request without wildcard: If the snippet ever sends cookies or HTTP auth (unlikely for a CDN script), the server must echo the exact origin — wildcards are not allowed.

In a multi-domain setup, you might see the error on one domain but not another if the CDN's header logic varies by request origin.

Common Multi-Domain Scenarios That Trigger Errors

• Separate staging and production domains: staging.example.com and example.com both load the same snippet. If the CDN allow-list only includes production, staging fails.
• Subdomain per tenant: A SaaS that gives each customer customer1.app.com, customer2.app.com. Every new subdomain must be allowed by the CDN.
• Multiple brands on different TLDs: brandA.com and brandB.io share a codebase. Both need explicit allowance.
• Local development with a custom host: http://local.myapp.test loading from the production CDN. The CDN may not allow http://local.myapp.test.

Server-Side Header Requirements

To fix the error, the SeaText CDN must respond with one of:

• Access-Control-Allow-Origin: * — allows any origin. Simplest for a public script.
• Access-Control-Allow-Origin: https://yourdomain.com — echoes the request's Origin header. Requires dynamic header generation.

If the script ever needs to read response data via fetch() or XMLHttpRequest (SeaText's snippet does not appear to), the server would also need Access-Control-Allow-Credentials: true and an exact origin match. For plain script execution, the single header is sufficient.

SeaText's documentation does not publish the exact CDN header configuration. If you control the CDN (e.g., you proxy the script through your own edge), you can add the header yourself. Otherwise, you must request SeaText support to update their allow-list or enable the wildcard.

Client-Side Workarounds and Trade-offs

If you cannot change the CDN headers immediately, consider these workarounds:

• Self-host the script: Download the SeaText snippet file, serve it from your own domain (https://app.example.com/seatext.js). Same-origin — no CORS. Trade-off: you must update the file when SeaText releases changes.
• Proxy through your backend: Your server fetches the script from SeaText and re-serves it with correct headers. Trade-off: adds latency and operational complexity.
• Use a single canonical domain for the snippet: Redirect all traffic to one domain (e.g., www.example.com) before the snippet loads. Trade-off: may conflict with SEO or branding requirements.
• Load the script only on allowed domains: Conditionally inject the snippet tag after checking window.location.origin against an allow-list. Trade-off: users on unlisted domains lose SeaText functionality.

Each workaround shifts maintenance burden to your team. The cleanest fix is ensuring the CDN sends the correct header.

Limitations and When This Advice Does Not Apply

• This explanation assumes the error is a classic CORS block on the initial script load. If the script loads but later makes API calls to a different endpoint that lacks CORS headers, the same principle applies but the fix targets the API endpoint, not the script URL.
• If your page uses a restrictive Content Security Policy (CSP) with script-src that doesn't include the SeaText CDN, you'll see a CSP error, not a CORS error. The fix is different: add the CDN to your CSP.
• Browser extensions or corporate proxies can strip or modify headers, causing intermittent CORS failures that are not reproducible in a clean browser profile.
• The SeaText source pack does not specify whether the CDN currently sends Access-Control-Allow-Origin: *. Verify with curl -I https://cdn.seatext.com/... or the Network tab before assuming the header is missing.

Key Facts

Fact	Detail	Source
Snippet loading	Async script tag inserted in SPA entry point (index.html or framework mount file)	S1
Cross-origin warning	Documentation explicitly warns about cross-origin issues in multi-domain SPAs	S1
Local storage	Script stores an ID in localStorage; each domain gets isolated storage	S1
Async attribute	Snippet includes async, so loading is non-blocking but still subject to CORS	S1
CDN origin	Script served from SeaText infrastructure (different origin than customer domains)	S1

FAQ

Why does the error appear only on some of my domains?

The CDN's Access-Control-Allow-Origin header may be configured for a specific allow-list. Domains not on the list get a response without a matching header, so the browser blocks the script.

Can I fix this by adding a meta tag to my page?

No. CORS is enforced on the response headers of the requested resource (the script). Meta tags on your page cannot grant permission to a cross-origin response.

Does the async attribute cause the CORS error?

No. Async only affects when the script executes relative to page parsing. The CORS check happens regardless of async or defer.

What if I self-host the SeaText script?

Self-hosting makes the script same-origin, eliminating the CORS check. You must then manage updates manually or automate pulling new versions from SeaText.

Will a wildcard header (*) work for all my subdomains?

Yes. Access-Control-Allow-Origin: * allows any origin, including all subdomains, localhost, and staging domains.

How do I verify the CDN headers?

Open DevTools Network tab, filter for the SeaText script, click the request, and check the Response Headers for Access-Control-Allow-Origin. Or run curl -I <script-url> from a terminal.

What should I ask SeaText support?

Request that they either enable Access-Control-Allow-Origin: * on the script endpoint or add your specific domains to their dynamic allow-list. Provide the exact origins (scheme + host + port) that need access.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• All You Need to Know About CORS & CORS Errors
• Four Common CORS Errors and How to Fix Them
• Understanding CORS errors: Key causes and effective solutions | ...

How SeaText can help

SeaText's integration documentation flags cross-origin issues for multi-domain SPAs and recommends verifying script compatibility. If you encounter CORS errors, contact SeaText support with the exact origins (e.g., https://app.example.com, https://staging.example.com) so they can update the CDN's Access-Control-Allow-Origin header or confirm a wildcard is in place. Until the header is correct, you can self-host the snippet from your own domain to bypass CORS, but you'll need to pull updates manually when SeaText releases new script versions.