[wp-trac] [WordPress Trac] #64886: Media: Remove `IMG` from cross-origin isolation `crossorigin="anonymous"` injection.

[WordPress Trac]

#64886: Media: Remove `IMG` from cross-origin isolation `crossorigin="anonymous"`
injection.
---------------------------------------------+-----------------------------
 Reporter:  adamsilverstein                  |       Owner:
                                             |  adamsilverstein
     Type:  defect (bug)                     |      Status:  closed
 Priority:  normal                           |   Milestone:  7.0
Component:  Media                            |     Version:  trunk
 Severity:  normal                           |  Resolution:  fixed
 Keywords:  has-patch has-unit-tests commit  |     Focuses:
---------------------------------------------+-----------------------------
Changes (by adamsilverstein):

 * status:  assigned => closed
 * resolution:   => fixed


Comment:

 In [changeset:"62048" 62048]:
 {{{
 #!CommitTicketReference repository="" revision="62048"
 Media: Remove `IMG` from crossorigin attribute injection.

 Under `Document-Isolation-Policy: isolate-and-credentialless`, the
 browser's credentialless mode already handles cross-origin image loading
 without requiring CORS headers. Explicitly adding
 `crossorigin="anonymous"` to `<img>` elements overrides this behavior and
 forces a CORS preflight request, breaking images from servers that don't
 include `Access-Control-Allow-Origin` in their response headers.

 This also removes the related `imagesrcset` handling from `LINK` elements,
 which had the same issue for `<link>` preload tags for images.

 See related Gutenberg issue:
 https://github.com/WordPress/gutenberg/issues/76476.

 Follow-up to [61844], [61846].

 Props adamsilverstein, swissspidy.
 Fixes #64886.
 }}}

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/64886#comment:6>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform