Bug 80028 – Setting crossOrigin attribute for images won't trigger onerror on CORS denial

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: Images

[Niklas von Hertzen]

Created attachment 129704 [details]
example where onerror / onload isn't triggered

When defining the crossOrigin attribute for an Image element, it won't return an onload/onerror event if the image exists, but denied by CORS policy. In other words, there is no event to determine when the image has finished loading and whether it managed to load it, unless you check with timers for the complete attribute to change. 

The expected result would be for the onerror event of the image to be triggered (as it does in Firefox), and as defined in http://www.whatwg.org/specs/web-apps/current-work/multipage/embedded-content-1.html#attr-img-crossorigin "Set the img element to the broken state, and fire a simple event named error at the img element."

Tested on both 19.0.1057.0 canary and 17.0.963.56 m, and neither is triggering the real onerror in the example.

[Alexey Proskuryakov]

There should be no way to differentiate between non-existent resources and

[Alexey Proskuryakov]

Taking that unfinished comment back, this doesn't seem like security.

[Adam Barth]

I'm going to try to fix this bug next week.  If someone else is excited about fixing it sooner, go for it.

[Adam Barth]

@mkwst: Here's the related bug for CORS.  I thought I fixed this though...  Maybe I did it in a different bug.

[Adam Barth]

*** This bug has been marked as a duplicate of bug 81998 ***