4 ms·

How can CORS possibly be related to image pixels in any way?

• bitL 9y ago
  For some reason every single pixel access must be authorized through CORS. I am not sure if this is in the standard or just shoddy implementation in all browsers. Try it yourself, read pixels in one non-CORSed image, and then in CORSed and wonder what went wrong on the drawing board. Some people bypass it via WebGL.
  • DiThi 9y ago
    > Some people bypass it via WebGL. How? There's no concept of a tainted WebGL canvas because it just can't load textures without CORS.
    • bitL 9y ago
      Not sure if it still works but it used to work before (~2 years ago). Maybe it was fixed in the meantime.
      • DiThi 9y ago
        That totally sounds like a bug to me, it shouldn't happen.
• missblit 9y ago
  It's to prevent reading cross-origin images through JavaScript. A canvas is considered tainted if it contains data from a cross origin image that was loaded without CORS approval. Tainted canvases cannot be read from by JavaScript. I don't think this requires a 1000x slowdown but I'm not super familiar with this area of the spec. It should be possible to cache the tainted state of the canvas in a single bit, only updating it when adding new images to the canvas, and checking the bit when converting the canvas to an array.