I have https://domain1.com (domain1) and https://domain2.com (domain2).
Domain2 serves a page containing javascript with this header:
"Access-Control-
It's pretty funny, but importScripts() inside the worker does not have the same origin restriction. So I used this plain workaround:
const workerUrl = 'https://domain2.com/script.js';
const workerBlob = new Blob([
'importScripts(' + JSON.stringify(workerUrl) + ')',
], {type: 'application/javascript'});
const blobUrl = window.URL.createObjectURL(workerBlob);
const worker = new Worker(blobUrl);
Somewhat simpler than fetching script manually.