3 ms·
I wonder how much of the web would break if non-same-origin images just couldn't be used in canvases, or in any way other than in an img tag that shows the whol
by JoshTriplett 6y ago
I wonder how much of the web would break if non-same-origin images just couldn't be used in canvases, or in any way other than in an img tag that shows the whole unmodified undecorated image?
I get why non-same-origin images need to keep working. I'm curious what depends on using non-same-origin images in canvas rendering, and how hard it'd be for those sites to migrate to loading those images first-party.
- nemothekid 6y agoI can give one data point - you have a site that is hosted via static site generator (something like netlify) and users can upload images (that you probably store on S3). Then you provide a service that requires drawing on those images (maybe a map, or heatmap, or some markup tool). Usually you learn that the canvas is tainted and you adjust CORS accordingly. Forcing same-site would require a server side proxy (defeating the point of using a CDN).
- JoshTriplett 6y agoWhy a server-side proxy, rather than just putting S3 behind the same CDN (which will probably save you bandwidth charges at the same time)?
- nemothekid 6y agoIf you are using something like Netlify, then you would need them to serve your S3 content from their CDN (which I don't think they support). For my specific use case, we host our application on our own domain (on our PaaS), then use a CDN for static assets. If we needed to also serve s3 assets from the same domain then it would mean routing routes in that node application to serve from s3 (effectively a server side proxy).