This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 19574 - crossOrigin should be limited to only known values
Summary: crossOrigin should be limited to only known values
Status: RESOLVED FIXED
Alias: None
Product: WHATWG
Classification: Unclassified
Component: HTML (show other bugs)
Version: unspecified
Hardware: Other other
: P3 normal
Target Milestone: Unsorted
Assignee: Ian 'Hixie' Hickson
QA Contact: contributor
URL: http://www.whatwg.org/specs/web-apps/...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-10-17 11:48 UTC by contributor
Modified: 2013-06-10 22:55 UTC (History)
3 users (show)

See Also:

Attachments

Description contributor 2012-10-17 11:48:07 UTC 
Specification: http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html
Multipage: http://www.whatwg.org/C#dom-media-crossorigin
Complete: http://www.whatwg.org/c#dom-media-crossorigin

Comment:
crossOrigin should be limited to only known values

Posted from: 2001:4c28:a030:30:1c1:b61a:7408:69dc by simonp@opera.com
User agent: Opera/9.80 (Macintosh; Intel Mac OS X 10.7.4; U; en) Presto/2.10.289 Version/12.02
Comment 1 Simon Pieters 2012-10-17 11:49:22 UTC 
Currently crossorigin="" means anonymous but crossOrigin returns "" for both that and missing attribute (which maps to the No CORS state). It is also harder to test for new states we introduce later without limiting to only known values.
Comment 3 contributor 2013-01-26 01:00:48 UTC 
Checked in as WHATWG revision r7653.
Check-in comment: Try to make crossOrigin more future-proof.
http://html5.org/tools/web-apps-tracker?from=7652&to=7653
Comment 4 Simon Pieters 2013-06-10 20:46:24 UTC 
The fix doesn't address this:

(In reply to comment #1)
> Currently crossorigin="" means anonymous but crossOrigin returns "" for both
> that and missing attribute (which maps to the No CORS state).

The spec should make crossorigin="" have .crossOrigin return "anonymous"
Comment 5 contributor 2013-06-10 22:55:54 UTC 
Checked in as WHATWG revision r7951.
Check-in comment: Make clear that .crossOrigin doesn't return '' for the Anonymous state.
http://html5.org/tools/web-apps-tracker?from=7950&to=7951