The company I work for runs a user profile photo server. I would like to fetch, visually modify (add a blur, some effects, etc.), and display those images in <canvas>. The problem is that the photo server is located on a different origin and when I add a fetched image to the canvas, it gets tainted, preventing me from working with the image.

Are there security implications in enabling CORS for images? What can a malicious person do?

  • since the profile pics can already be shown w/o cors i don't see any major risks. it could allow zombies from XSS to perform operations on the images. eg. OCR on any images, reading the EXIF meta data, which might leak confidential info, but it wouldn't pose a DOS or application attack vector.
    – dandavis
    Commented May 29, 2016 at 4:09

1 Answer 1


Depends how you set it up. If you allow Cross Origin Requests from any domain, then an attacker who finds the image URLs can do anything you can do within your Javascript application - the security is exactly the same as what you have. If you restrict the requests to your specific application server, they shouldn't be able to do anything, just as you can't at the moment.

CORS is aimed to prevent client side attacks such as loading an image which the remote site can't see (with an image tag to a, for example, Facebook server), then copying the content to their server without the client being aware. Therefore, the situation you describe is exactly what it handles well.

In this case, it is more important that any functions to save the modified images to the server are secure, since these could result in server compromise, or simply in third party sites using your system as a way to store their images. Don't forget that even with CORS enabled, an attacker can easily load images directly from your server if you don't perform proper authentication steps - for example, by running a cURL command on the image URL.

  • If there's no functionality to save the modified images, what is the worst thing that an attacker can do? Steal the images while pretending to be our customer? Steal other sensitive data? Disrupt the service?
    – Oleg
    Commented May 27, 2016 at 17:14
  • @Matthew my bad - misunderstood the question.
    – grc
    Commented May 28, 2016 at 11:59
  • @Oleg: Yes, steal the images using the browsing context of the user. You can always enable CORS for your origin only. Commented May 31, 2016 at 14:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .