Accepts only an absolute HTTP(S) URL on an allowed origin and without
embedded credentials, so a package cannot direct the loader at an
unannounced host, at a non-HTTP scheme, or at an authenticated endpoint.
allowedOrigins defaults to the base URL's own origin. An embedder that
serves one package from more than one host widens it deliberately; the
package itself never gets a say, which is what makes this loader policy.
Accepts only an absolute HTTP(S) URL on an allowed origin and without embedded credentials, so a package cannot direct the loader at an unannounced host, at a non-HTTP scheme, or at an authenticated endpoint.
allowedOriginsdefaults to the base URL's own origin. An embedder that serves one package from more than one host widens it deliberately; the package itself never gets a say, which is what makes this loader policy.