I'm trying to call a javascript file in another directory of the same server but I'm blocked by CORS policy while my htaccess shouldn't prevent that.

I have mydomain.com pointing to /directory1/ where index.php captures all the requests:

RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?path=$1 [NC,L,QSA]

If I call a JS file inside /directory1/, it will send me back to index.php. That's why I have moved the js file to another directory /directory2/ and I'm simply calling that JS with:

<script src="mydomain.com/directory2/test.js" type="module"></script>

in that directory, I have a .htaccess file with the following content:

<IfModule mod_headers.c>
Header set Access-Control-Allow-Origin "*"
</IfModule>

RewriteEngine On
RewriteCond %{ENV:HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Accessing the file directly into the browser works but accessing it from the script src doesn't work.

I have a CSP in directory1 using the following directive:

Header set X-XSS-Protection "1; mode=block" Header always append X-Frame-Options SAMEORIGIN Header set X-Content-Type-Options: "nosniff” Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' *mydomain.com" Header set Referrer-Policy "same-origin"

Am I missing something somewhere? I don't get a CSP error, I get a CORS error so I suppose my CSP is not the issue here.

Thanks