[csswg-drafts] [css-values-5] Precedence of <request-url-modifier> over consumer-imposed fetch requirements (#13859)

dumbmoron has just created a new issue for https://github.com/w3c/csswg-drafts:

== [css-values-5] Precedence of <request-url-modifier> over consumer-imposed fetch requirements ==
[&lt;request-url-modifier&gt;](https://drafts.csswg.org/css-values-5/#request-url-modifiers)s mutate a request's mode, credentials mode, integrity metadata, and referrer policy. The [fetch a style resource](https://drafts.csswg.org/css-values-4/#fetch-a-style-resource) algorithm applies them in step 5, after the consumer's corsMode argument has already been baked into the request in step 4. As a result, the supplied modifiers always win over the consumer's choice.

But several consumer specs normatively mandate Anonymous mode:
- https://drafts.csswg.org/css-masking-1/#sec - `mask-image`, `mask-border-source`, `clip-path`
- https://drafts.csswg.org/css-shapes/#shape-outside-property - `shape-outside: <image>`
- https://drafts.csswg.org/filter-effects-1/#origin-restrictions - `filter: url(#...)`
- https://drafts.csswg.org/css-fonts-4/#sp213 - `@font-face`

all have this line:
> When fetching, user agents must use “Anonymous” mode, set the referrer source to the stylesheet’s URL and set the origin to the URL of the containing document.

Under the current spec text, e.g.: `mask-image: url("https://other.example/secret.png" cross-origin(use-credentials));` would credentialize the fetch, contradicting css-masking §11, similarly applicable to all other examples above.

This question was raised before, by @emilio in [this discussion](https://github.com/w3c/csswg-drafts/issues/1603#issuecomment-1505619189):
```
<emeyer> emilio: I just realized we force crossorigin to be anonymous for CSS already
<emeyer> …We need to define whether you can override it; I don’t think you should be able to
...
<emeyer> …Masks, for example, require anonymous crossorigin loads
<emeyer> …So we should define that
<emeyer> TabAtkins: I don’t think they’re defined in a way that hooks into these, so we need to review that
```

I'd like to ask for a clarification on what should apply here. From the fetch algorithm, author modifiers win. But that's not obvious from the spec text and contradicts the four consumer specs above. Could the editors clarify the intended precedence?

cc @noamr @weinig @tabatkins @AmeliaBR @emilio @AtkinsSJ, related to: #1603

Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/13859 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Wednesday, 29 April 2026 13:41:26 UTC