CORS issues with Lightning Out and managed package

Question

I have the following situation :

Dev Org A, with package domain orgA and my domain orgA-dev-ed.my.salesforce.com
Created a package packageA, which contains :
- a static resource : a zip containing a css and related font (linked by relative url - think about SLDS)
- a component orgA:cmpA including this css using ltng:require, and using the font

Dev Org B, with package domain orgB and my domain orgB-dev-ed.my.salesforce.com
Installed packageA.
Created :
- a component orgB:cmpB, which is embedding orgA:cmpA
- a lignthing app orgB:appB embedding orgB:cmpB
- a lignthing app orgB:appBout with aura:dependency orgB:cmpB
- a visualforce page pageB, using Lightning Out to display orgB:cmpB with help of orgB:appBOut

Now I have the following behavior :
- appB is working perfectly well. It is served from https//orgB-dev-ed.lightning.force.com/orgB/appB.app (and the same for all resources)
- pageB is getting the css but NOT the right font.

What is happening behind the scene is :

1. pageB is served from https//orgB-dev-ed--orgB.eu5.visual.force.com/apex/pageB

2. css is then asked with RequestUrl https/orgB-dev-ed--orgB.eu5.visual.force.com/resource/orgA__bundle/css, which is redirected to https//orgB-dev-ed--orgA.eu5.visual.force.com/resource/orgA__bundle/css and successfully served

3. font is asked with RequestUrl https//orgB-dev-ed--orgA.eu5.visual.force.com/resource/orgA__bundle/font , with Origin https//orgB-dev-ed--orgB.eu5.visual.force.com and with Referrer https//orgB-dev-ed--orgA.eu5.visual.force.com/resource/orgA__bundle/css which triggers a CORS issue

Do I miss something or is it a problem with the way Lightning Out is currently working ?

Answer 1

So far the way to fix this was to disable the critical update “Serve Static Resources from the Visualforce Domain”.