This is a design problem with img elements, but it looks mostly fixable to me. If browsers sent an "I'm expecting this to be an image" header, possibly even jus

This is a design problem with img elements, but it looks mostly fixable to me. If browsers sent an "I'm expecting this to be an image" header, possibly even just Accept: image/*, and servers took advantage of this information to avoid leaking info to 3rd parties, then flaws like this would only exist for image resources.