I found this solution for a very similar problem, which is roughly the same approach: http://dira.ro/2011/10/17/heroku-s3-canvas-and-the-security-error-of-doom

I found this solution for a very similar problem, which is roughly the same approach: http://dira.ro/2011/10/17/heroku-s3-canvas-and-the-security-error-of-doom http://dira.ro/2011/10/17/heroku-s3-canvas-and-the-security-... Implementation here: https://github.com/dira/cross-domain-image-proxy https://github.com/dira/cross-domain-image-proxy And a jQuery plugin here: https://github.com/rlmattax/jquery-s3-image-proxy https://github.com/rlmattax/jquery-s3-image-proxy After weighing the pros and cons of proxying versus this, I settled on the postMessage strategy -- but still no fun at all, and I'm so glad that CORS is finally an option.