# A “script” element with a “type” attribute whose value is neither a JavaScript MIME type, “module”, “importmap”, nor “speculationrules” (i.e., a data block) must not have a “crossorigin” attribute.

> Canonical HTML version: https://rocketvalidator.com/html-validation/a-script-element-with-a-type-attribute-whose-value-is-neither-a-javascript-mime-type-module-importmap-nor-speculationrules-i-e-a-data-block-must-not-have-a-crossorigin-attribute
> Attribution: Rocket Validator (https://rocketvalidator.com)
> License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)

The `crossorigin` attribute is invalid on a `<script>` element whose `type` marks it as a data block, because browsers never fetch a data block over the network.

When the `type` attribute is anything other than a JavaScript MIME type, `module`, `importmap`, or `speculationrules`, the browser treats the element as a data block: inline content that other scripts on the page can read, but that never runs. The most common example is `application/ld+json` structured data. A data block can't have a `src` attribute either, so the browser makes no request for it.

`crossorigin` sets the CORS mode the browser uses when it downloads an external script, and for classic scripts it also decides whether error details from another origin reach `window.onerror`. With no download and no execution, the attribute has nothing to apply to.

This usually happens when a build step or plugin adds `crossorigin` to every `<script>` tag on the page, including the data blocks.

## Invalid example

```html
<script type="application/ld+json" crossorigin="anonymous">
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "name": "Example"
  }
</script>
```

## Valid example

```html
<script type="application/ld+json">
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "name": "Example"
  }
</script>
<script src="https://cdn.example.com/app.js" crossorigin="anonymous"></script>
```

Remove `crossorigin` from the data block and keep it on the scripts the browser actually downloads. If the element was meant to run, fix the `type` instead: use `module`, a JavaScript MIME type such as `text/javascript`, or leave `type` out.