Using the Crossorigin Attribute for Better Performance

The crossorigin attribute is an essential part of web development, particularly when working with external resources like scripts, stylesheets, or images. It defines how resources are loaded and shared across different origins, ensuring secure and efficient handling of cross-origin requests.

In this blog, we'll explore what the crossorigin attribute is, how it works, and why it's important for modern web applications.

What is the crossorigin Attribute?

The crossorigin attribute in HTML defines how a web element should handle cross-origin requests for its resources. It plays a crucial role in enabling Cross-Origin Resource Sharing (CORS), ensuring that fetched resources like images, scripts, or fonts comply with specified security and access policies.

This attribute specifies whether user credentials, such as cookies or HTTP authentication data, should be sent during a CORS request. Supported attribute values include:

• anonymous: Fetches resources without sending credentials.
• use-credentials: Fetches resources while sending credentials.
• If left unspecified or set to an invalid value, it defaults to anonymous.

How the crossorigin Attribute Handles Cross-Origin Requests

The crossorigin attribute determines the CORS request mode, especially for resources sourced from third-party servers or other domains. This is crucial for ensuring secure cross-origin access under browser security models.

Here’s how it works:

• CORS Requests: When a resource (e.g., a script or image) is fetched from a different domain, the crossorigin attribute controls whether credentials like cookies are sent.
• Same-Origin vs. Cross-Origin: By default, browsers block requests to a third-party domain if proper CORS headers are not configured.
• HTTP CORS Request: With the crossorigin attribute, a web page can fetch resources under controlled policies, mitigating errors such as CORS blocking or failed image data retrieval.

For instance, fetching a font from another domain requires enabling CORS to ensure the font is rendered correctly on the page.

Use Cases and Best Practices

Common Use Cases

• Loading a JS file or a font from a third-party server.
• Embedding external resources, such as images, into a same-origin canvas.
• Ensuring secure password submit post actions with external APIs.
• Avoiding CORS errors when handling image manipulation via getImageData().

Best Practices

1. Use anonymous for resources that don’t require sending user credentials:

2. Use use-credentials for secure API requests requiring cookies:

3. Avoid setting invalid or unspecified values, as the attribute defaults to anonymous.

4. Use the crossorigin attribute on tags for Google Sign-In implementations and Google Chrome optimizations:

Implementing the crossorigin Attribute Correctly

Examples for Different Tags

1. Script Tag: To securely load external scripts:

2. Image Tag: Prevent cross-origin errors for canvas rendering:

3. Link Tag: Load fonts or stylesheets from another domain:

Avoiding Errors

• Empty String: Setting the attribute to an empty string is treated as anonymous.
• Invalid Keyword: Browsers default to anonymous for unsupported values.
• No Attribute: Prevents CORS configuration and cross-origin access entirely.

Why Do We Write crossorigin in Script Tags?

Using the crossorigin attribute in tags ensures that the browser fetches and executes scripts securely. It validates the script's integrity and manages credentials for same-origin or cross-origin requests. For example:

• Fetching a library securely:

Final Notes

The crossorigin attribute is a valuable feature in web development that helps control how resources, such as scripts and images, are loaded from other domains. Proper use of the crossorigin attribute enhances performance and security in modern web applications.

<script src="https://cdn.example.com/script.js" crossorigin="anonymous"></script>

<img src="https://secure.example.com/image.png" crossorigin="use-credentials">

<script src="https://accounts.google.com/gsi/client" crossorigin="anonymous"></script>

<script src="https://cdn.thirdparty.com/library.js" crossorigin="anonymous"></script>

<img src="https://images.domain.com/photo.jpg" crossorigin="anonymous">

<link href="https://fonts.googleapis.com/css2?family=Roboto" rel="stylesheet" crossorigin="anonymous">

<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js" crossorigin="anonymous"></script>