[whatwg] window.onerror and cross-origin scripts

Simon Pieters simonp at opera.com
Fri Sep 23 00:16:43 PDT 2011

On Thu, 22 Sep 2011 16:02:30 +0200, Simon Pieters <simonp at opera.com> wrote:

> I was talking about window.onerror. <script onerror> per spec fires for  
> empty src="", unresolvable URL and network errors (DNS or 404). If we  
> want to make onload always fire for cross-origin, it would make sense  
> for <script onerror> to not fire for network errors. (Opera doesn't fire  
> error on script, assuming my testing isn't bogus this time.)
> I don't know if it's worth it to try to plug this hole this way,  
> however. We won't be able to plug it everywhere, e.g. <img> will expose  
> if an image is loaded. So masking onload/onerror for script just makes  
> the feature less useful without solving the problem. Maybe we should  
> instead focus on implementing the From-Origin header and try to get  
> sites to use that.

It was pointed out to me that the following site expects an error event  
for a cross-origin script (which returns 404):


which tries to load http://lp.longtailvideo.com/5/%20gapro/%20gapro.js

Simon Pieters
Opera Software

More information about the whatwg mailing list