# dynamic import breakage / cross-origin frame issue

**URL:** <https://talk.observablehq.com/t/dynamic-import-breakage-cross-origin-frame-issue/2817>\
**Category:** Help\
**Created:** [February 7, 2020, 2:39am UTC](https://talk.observablehq.com/t/dynamic-import-breakage-cross-origin-frame-issue/2817 "2020-02-07T02:39:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pentacular](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/pentacular/32/2502_2.png) [@pentacular](https://talk.observablehq.com/u/pentacular)\
**Post date:** [February 7, 2020, 2:39am UTC](https://talk.observablehq.com/t/dynamic-import-breakage-cross-origin-frame-issue/2817/1 "2020-02-07T02:39:19Z")

</div>

Hello,

Suddenly all of my notebooks have started to fail due to: “Failed to fetch dynamically imported module”

This is due to an attempt to import an es6 module from gitcdn.

In chrome, I see “DOMException: Blocked a frame with origin “[https://observablehq.com](https://observablehq.com)” from accessing a cross-origin frame.”

This used to work yesterday in the same chrome instance, so I guess there has been a recent change.

The notebook in question is: [https://observablehq.com/@pentacular/jsxcad-shapes](https://observablehq.com/@pentacular/jsxcad-shapes)

Anyone know what is going on?

Thanks.

---

<div class="post-metadata">

**Author:** ![mbostock](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/mbostock/32/9_2.png) [@mbostock](https://talk.observablehq.com/u/mbostock)\
**Post date:** [February 7, 2020, 3:08am UTC](https://talk.observablehq.com/t/dynamic-import-breakage-cross-origin-frame-issue/2817/2 "2020-02-07T03:08:59Z")

</div>

Hrm. I’m not seeing any errors. Do you have an ad-blocker enabled that might be preventing the request? Does the error still occur if you try another browser? You could also try publishing the library to npm so you can use jsDelivr for hosting (which is what we use for require and has been reliable), or attaching the library as a file to your notebook.

---

<div class="post-metadata">

**Author:** ![pentacular](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/pentacular/32/2502_2.png) [@pentacular](https://talk.observablehq.com/u/pentacular)\
**Post date:** [February 7, 2020, 3:34am UTC](https://talk.observablehq.com/t/dynamic-import-breakage-cross-origin-frame-issue/2817/3 "2020-02-07T03:34:28Z")

</div>

I just refreshed the page and it worked this time.

It seems odd that a CORS error would just pop up – but let’s see how it goes.  
Maybe a pattern will become clear.

Thanks.

---

<div class="post-metadata">

**Author:** ![mbostock](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/mbostock/32/9_2.png) [@mbostock](https://talk.observablehq.com/u/mbostock)\
**Post date:** [February 7, 2020, 3:52am UTC](https://talk.observablehq.com/t/dynamic-import-breakage-cross-origin-frame-issue/2817/4 "2020-02-07T03:52:25Z")

</div>

If it was GitCDN having issues, it could have easily manifested as a CORS errors: most servers don’t return CORS headers on their 500 error pages.

---

<div class="post-metadata">

**Author:** ![pentacular](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/pentacular/32/2502_2.png) [@pentacular](https://talk.observablehq.com/u/pentacular)\
**Post date:** [February 7, 2020, 4:07am UTC](https://talk.observablehq.com/t/dynamic-import-breakage-cross-origin-frame-issue/2817/5 "2020-02-07T04:07:02Z")

</div>

Could be, although I recall being able to load the page manually without any problem while it was failing to import.

---

<div class="post-metadata">

**Author:** ![brizeljohn](https://avatars.discourse-cdn.com/v4/letter/b/9fc348/32.png) [@brizeljohn](https://talk.observablehq.com/u/brizeljohn)\
**Post date:** [January 10, 2023, 3:18pm UTC](https://talk.observablehq.com/t/dynamic-import-breakage-cross-origin-frame-issue/2817/6 "2023-01-10T15:18:57Z")

</div>

> [@pentacular](#):
>
> In chrome, I see “DOMException: Blocked a frame with origin “[https://observablehq.com](https://observablehq.com)” from accessing a cross-origin frame.”

This error "Blocked a frame with origin from accessing a [cross-origin frame](http://net-informations.com/js/err/sop.htm) " is not a bug. The same-origin policy is a security mechanism that ensures that window objects only have access to the informations they are authorized to get.

The window.postMessage() method provides a controlled mechanism to securely circumvent this Same-Origin Policy restriction. The window.postMessage() safely enables cross-origin communication between Window objects; e.g: between a page and an iframe embedded within it.

```auto
postMessage(message, targetOrigin)
postMessage(message, targetOrigin, [transfer])

```

targetOrigin - specifies what the origin of targetWindow must be for the event to be dispatched, either as the literal string “\*” (indicating no preference) or as a URI.