[w3ctag/design-reviews] CORS Requirement for 3rd party sources in <model> tag (Issue #775)

Wotcher TAG!

I'm requesting the TAG express an opinion on a dispute related to: Whether the model tag should require CORS for 3rd party sources.

  - Name: Model Element
  - Specification URL: [spec url](https://immersive-web.github.io/model-element/)
  - [Explainer](https://github.com/immersive-web/model-element/blob/main/explainer.md) 
  - GitHub issue (if you prefer feedback filed there): [[url]](https://github.com/immersive-web/model-element/issues/56)
  - Primary contacts: AdaRoseCannon, marcoscaceres, cabanier
  - The group where the work on this specification is: Immersive Web
  - Relevant time constraints or deadlines: Not urgent

We recommend the explainer to be in Markdown.

Explanation of the issue that we'd like the TAG's opinion on:

Model is like a media element, other media elements like `<img>`, `<video>` and `<audio>` can play without CORS but there seems to be a pattern for newer APIs to require it like `<script type="module">` vs `<script>`.

Links to the positions of each side in the dispute, this was amicably discussed at TPAC 2022

What steps have already been taken to come to an agreement: Discussion weighing security issues with benefits to users. Couldn't really settle on best answer and thought if the requiring CORS is the modern way of doing it then that that is what we should go with.

We'd prefer the TAG provide feedback as (please select one):

  - [x] leave a comment in the following GitHub issue: https://github.com/immersive-web/model-element/issues/56
  - [ ] leave review feedback as a comment in this issue and @-notify [github usernames]
  - [ ] open a new issue in our GitHub repo with the feedback

Thank you,

Ada Rose Cannon, Immersive Web co-chair.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/775
You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/775@github.com>