Re: [ServiceWorker] "no-cors" CSS SOP violation (#719)

CSS has no author-level equivalent for "crossorigin" for fetches declared via `url()` - i.e. I can't specify a CORS policy on resources specified _within_ the CSS file. As such, all `url()` initiated fetches (read, _almost all_ CSS fetches modulo some odd exceptions like web fonts), would become invisible? Unless I'm missing something here, that would break the web.

Why can SW see and intercept no-cors crossorigin `<img>` initiated fetches, but same use case then fails under CSS? This seems inconsistent and broken.

_p.s. the whole `crossorigin` business is a total mess - see https://github.com/w3c/resource-hints/issues/32._

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/719#issuecomment-120992034

Received on Monday, 13 July 2015 16:54:09 UTC