[whatwg] CORS requests for image and video elements

[Ian Hickson]

On Thu, 19 May 2011, Chris Double wrote:
> On Wed, May 18, 2011 at 1:11 PM, Ian Hickson <ian at hixie.ch> wrote:
> > This is only a first draft, I'm not sure it's perfect. In particular, 
> > right now cross-origin media is not allowed at all without this 
> > attribute (this is not a new change, but I'm not sure it's what 
> > implementations do).
> 
> Last I checked Amazon S3 and other large content serving sites don't 
> support CORS. Does this mean a number of existing sites using Amazon S3 
> as their backend would break?

The change was backwards-compatible with the previous state of the spec, 
so nothing would break if it was working before. However, if browsers 
didn't enforce the same-origin check before for <video>, then yes, if 
they implemented it now things would break.

I've changed this so that <video> now works like <img>; it doesn't send an 
Origin: header by default, taints cross-origin videos but doesn't block 
them, and supports the attribute the same way. <track> (the element for 
text tracks) doesn't do the tainting thing, it either allows or disallows, 
and is controlled by the <video> element's cross-origin="" attribute, so 
that you don't have to specify it a dozen times for each media element. 
(Same with <source>, it's controlled by the <video> element's 
cross-origin="" attribute.) The "Origin:" header for all these cases isn't 
sent unless the cross-origin="" attribute is specified. (Previously, 
<track> and <video> were specified to include it always.)


On Thu, 19 May 2011, Robert O'Callahan wrote:
> 
> What exactly do you mean by "cross-origin media is not allowed at all"? 
> I hope you mean "CORS is not used at all", since obviously image and 
> media elements are allowed to load resources cross-origin today, and 
> changing that would break the Web.

<img> obviously allows cross-origin access, yes. The spec didn't allow it 
for <video>, as it turns out. This is fixed now.


On Fri, 20 May 2011, Gregg Tavares (wrk) wrote:
>
> How about updating the CORS spec so that a server can send a
> 
>    Access-Control-Allow-Origin: *
> 
> header even when not specifically requested and the browser can then 
> allow those resource to be used cross-origin where otherwise they 
> wouldn't
> 
> This would mean sites like picasa and flickr could just add that static 
> string to their headers and things would just work, no HTML or JS 
> changes required, no having to tag images with cross-origin unless 
> you're dealing with a really strict server that actually wants to check 
> credentials.

We can't allow the "*" mode without the cross-origin="" attribute for the 
reasons Jonas posted earlier today, but I've made it support an explicit 
cross-origin opt-in, so if you know what domains are going to need it you 
can do the opt-in without adding the cross-origin="" attribute everywhere.

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'