[whatwg] [CORS] WebKit tainting image instead of throwing error from Boris Zbarsky on 2011-10-04 (public-whatwg-archive@w3.org from October 2011)

From: Boris Zbarsky <bzbarsky@MIT.EDU>
Date: Tue, 04 Oct 2011 15:06:29 -0400
Message-ID: <4E8B5935.2060206@mit.edu>

On 10/4/11 3:02 PM, Anne van Kesteren wrote:
> Sure, but not more than per usual. Note that if you do not specify the
> crossorigin attribute the image can still get untainted. And if it does
> not you would still display the image (as always).

Yes; the point of specifying crossorigin is to opt in to the security 
model we think the web _should_ have but that we can't roll out across 
the board.  Yet.

-Boris

Received on Tuesday, 4 October 2011 12:06:29 UTC