W3cubDocs

CORS settings attributes

Draft
This page is not complete.

The crossorigin attribute, valid on the <audio>, <img>, <link>, <script>, and <video> elements, provides support for CORS, defining how the element handles crossorigin requests, thereby enabling the configuration of the CORS requests for the element's fetched data. Depending on the element, the attribute can be a CORS settings attribute.

The crossorigin content attribute on media elements is a CORS settings attribute.

These attributes are enumerated, and have the following possible values:

Keyword	Description
`anonymous`	CORS requests for this element will have the credentials flag set to 'same-origin'.
`use-credentials`	CORS requests for this element will have the credentials flag set to 'include'.
`""`	Setting the attribute name to an empty value, like `crossorigin` or `crossorigin=""`, is the same as `anonymous`.

By default (that is, when the attribute is not specified), CORS is not used at all. The "anonymous" keyword means that there will be no exchange of user credentials via cookies, client-side SSL certificates or HTTP authentication as described in the Terminology section of the CORS specification, unless it is in the same origin.

An invalid keyword and an empty string will be handled as the anonymous keyword.

Prior to Firefox 83 the crossorigin attribute was not supported for rel="icon" there is also an open issue for Chrome.

Example: crossorigin with the script element

You can use the following <script> element to tell a browser to execute the https://example.com/example-framework.js script without sending user-credentials.

<script src="https://example.com/example-framework.js" crossorigin="anonymous"></script>

Example: Webmanifest with credentials

The use-credentials value must be used when fetching a manifest that requires credentials, even if the file is from the same origin.

<link rel="manifest" href="/app.webmanifest" crossorigin="use-credentials">

Specifications

Specification	Status	Comment
HTML Living Standard The definition of 'CORS settings attributes' in that specification.	Living Standard
HTML Living Standard The definition of 'crossorigin' in that specification.	Living Standard

Browser compatibilityUpdate compatibility data on GitHub Update compatibility data on GitHub Update compatibility data on GitHub

<script crossorigin>

	Desktop
	Chrome	Edge	Firefox	Internet Explorer	Opera	Safari
`crossorigin`	30	≤18	13	No	12	Yes Yes The `crossorigin` attribute was implemented in WebKit in WebKit bug 81438.

	Mobile
	Android webview	Chrome for Android	Firefox for Android	Opera for Android	Safari on iOS	Samsung Internet
`crossorigin`	Yes	Yes	14	?	?	Yes

<video crossorigin>

	Desktop
	Chrome	Edge	Firefox	Internet Explorer	Opera	Safari
`crossorigin`	?	≤18	12	?	?	?

	Mobile
	Android webview	Chrome for Android	Firefox for Android	Opera for Android	Safari on iOS	Samsung Internet
`crossorigin`	?	?	14	?	?	?

<link crossorigin>

	Desktop
	Chrome	Edge	Firefox	Internet Explorer	Opera	Safari
`crossorigin`	25	79	18	No	15	?

	Mobile
	Android webview	Chrome for Android	Firefox for Android	Opera for Android	Safari on iOS	Samsung Internet
`crossorigin`	37	Yes	18	?	?	Yes

Legend

Full support; No support
Compatibility unknown: Compatibility unknown