Re: [css-font-loading] Handling cross-origin CORS-tainted font faces

Tab Atkins wrote:

> 1. Put a "CORS-tainted" flag on FontFaces, set appropriately, and
> rewrite several of the search/iteration algorithms in the spec to skip
> tainted FontFaces unless you're a blessed caller.
>
> 2. Add a "OpaqueFontFace" interface which lacks most of the
> attributes, but has a private slot pointing to the real FontFace it
> represents (as usual, private slots are only visible/accessible to the
> implementation), and then just treat it as normal.

If style rules from a cross-origin stylesheet don't show up in the OM then
I think it makes more sense for FontFace objects to not be exposed via
FontFaceSet methods. Having "opaque" objects seems nasty. So I guess option
(1) would be one way to achieve this.

I also responded on the github thread.

Cheers,

John Daggett

​