Posted in Uncategorized

Suggestion: default crossOrigin of *Loader should be undefined

   January 6, 2021  1 Comment on Suggestion: default crossOrigin of *Loader should be undefined
Description of the problem

The default crossOrigin of some *Loaders under examples/js/loaders are Anonymous while base Loader‘s is undefined.

IMO, crossOrigin of all *Loaders should be undefined for security and consistency.

If you folks agree with this, I’ll make PR.

These loaders seems to have default Anonymous crossOrigin as far as I know from the grep command.

  • AssimpJSONLoader
  • AssimpLoader
  • BinaryLoader
  • ColladaLoader
  • GLTFLoader
  • MTLLoader
  • VRMLLoader
Three.js version
  • Dev
  • r87
  • …
Browser
  • All of them
  • Chrome
  • Firefox
  • Internet Explorer
OS
  • All of them
  • Windows
  • macOS
  • Linux
  • Android
  • iOS
Hardware Requirements (graphics card, VR Device, …)

Author: Fantashit

1 thought on “Suggestion: default crossOrigin of *Loader should be undefined”

  1. Just working through this now, and in the specific case of ImageLoader:

    • setting a crossOrigin value of undefined
    • drawing a loaded image onto a canvas
    • creating a new THREE.CanvasTexture based on that canvas

    results in a security error, because the canvas is “tainted”, so in that particular case undefined probably isn’t a sensible default.

Comments are closed.