Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
The company I work for runs a user profile photo server. I would like to fetch, visually modify (add a blur, some effects, etc.), and display those images in <canvas>. The problem is that the photo server is located on a different origin and when I add a fetched image to the canvas, it gets tainted, preventing me from working with the image.
Are there security implications in enabling CORS for images? What can a malicious person do?
Depends how you set it up. If you allow Cross Origin Requests from any domain, then an attacker who finds the image URLs can do anything you can do within your Javascript application - the security is exactly the same as what you have. If you restrict the requests to your specific application server, they shouldn't be able to do anything, just as you can't at the moment.
CORS is aimed to prevent client side attacks such as loading an image which the remote site can't see (with an image tag to a, for example, Facebook server), then copying the content to their server without the client being aware. Therefore, the situation you describe is exactly what it handles well.
In this case, it is more important that any functions to save the modified images to the server are secure, since these could result in server compromise, or simply in third party sites using your system as a way to store their images. Don't forget that even with CORS enabled, an attacker can easily load images directly from your server if you don't perform proper authentication steps - for example, by running a cURL command on the image URL.
