Three.js: Suggestion: default crossOrigin of *Loader should be undefined

[takahirox]

Description of the problem

The default crossOrigin of some *Loaders under examples/js/loaders are Anonymous while base Loader's is undefined.

IMO, crossOrigin of all *Loaders should be undefined for security and consistency.

If you folks agree with this, I'll make PR.

These loaders seems to have default Anonymous crossOrigin as far as I know from the grep command.

• AssimpJSONLoader
• AssimpLoader
• BinaryLoader
• ColladaLoader
• GLTFLoader
• MTLLoader
• VRMLLoader

Three.js version

• [x] Dev
• [ ] r87
• [ ] ...

Browser

• [x] All of them
• [ ] Chrome
• [ ] Firefox
• [ ] Internet Explorer

OS

• [x] All of them
• [ ] Windows
• [ ] macOS
• [ ] Linux
• [ ] Android
• [ ] iOS

Hardware Requirements (graphics card, VR Device, ...)

[Mugen87]

see b37706008b705805b1b197dafbac027e54a0342d

@mrdoob What was your motivation for setting Anonymous as the default value?

[takahirox]

I also found that the default crossOrigin of ImageLoader, TextureLoader, CubeTextureLoader is Anonymous now, too. 8aacfda2d9a826749b0f1e93f757b25b7b26db86

[msbit]

Just working through this now, and in the specific case of ImageLoader:

• setting a crossOrigin value of undefined
• drawing a loaded image onto a canvas
• creating a new THREE.CanvasTexture based on that canvas

results in a security error, because the canvas is "tainted", so in that particular case undefined probably isn't a sensible default.

[mrdoob]

@mrdoob What was your motivation for setting Anonymous as the default value?

I don't remember... Here are some old discussions: #779 #4653

[Mugen87]

Um, according to @msbit comment and https://github.com/mrdoob/three.js/issues/4653#issuecomment-41075425, anonymous seems to be the better default value for the loaders.

[mrdoob]

Hmm, yeah... If anything, we could change Anonymous to anonymous...

[takahirox]

IIRC, CORS setting will be propagated. @msbit 's case is expected result.

Security is often tradeoff between secure and capability. I prefer secured side as default, undefined crossOrigin, and apps (devs) set appropriate value when necessary. But not a strong preference.

[mrdoob]

As far as I remember, if crossOrigin is set to undefined textures do not load in the rawgit link. So if we set it to undefined by default we'll have to add loader.setCrossOrigin( 'anonymous' ) to all the examples.

[mrdoob]

It would also "break" A LOT of projects... But if someone has really good arguments for doing it we could reconsider.

[MarcelKlammer]

Setting crossOrigin to undefined rather than anonymous would not result in more security.

This security feature is located server side with a proper CORS configuration.

I don't think that sending Origin in the request header would do any harm in an everyday developer scenario.

[mrdoob]

Sounds good. Should we change Anonymous to anonymous though?

[msbit]

Should we change Anonymous to anonymous though?

Might be prudent, according to this:

An invalid keyword and an empty string will be handled as the anonymous keyword.

so we may simply be getting the anonymous behaviour through a bit of a quirk (though I'm not able to quickly find anything that indicates whether case is important).

[makc]

some old safari failed to load images with anonymous set if there were no cors headers. otherwise it is good default

[MarcelKlammer]

Every reference I found used "anonymous" all lower case.

[takahirox]

Setting crossOrigin to undefined rather than anonymous would not result in more security.

Thanks. This is what I wanted to know to discuss, how risky setting anonymous to default value. So there's no reason to push undefined for me as default now. But I just want the consistent default value across the loaders.