I have a micro-frontend setup using @module-federation/vite (Module Federation 2.x runtime, version 2.5.0): Host app : Pure frontend (React + Vite), no backend Remote app : React + Vite frontend, backed by a Spring Boot backend secured with Spring Security (LDAP-based session auth) Both apps are deployed on the same parent domain (e.g. *.gcrm.example.io ). Problem When the host app loads, it tries to fetch remoteEntry.js from the remote.