title: Browser Canvas CORS Support for Cross Domain Loaded Image Manipulation
body: <p><strong>QUESTION: What browser versions support CORS (Cross-Origin Resource Sharing) headers for Cross Domain <em>Images</em> used in Canvas?</strong></p>
  
  <p>CORS can apply to both cross domain XMLHttpRequests and to image requests. This question is about <em>image requests</em>  My normal go to for browser version compatibility  <a href="http://caniuse.com/cors">http://caniuse.com/cors</a> is unclear on the issue and google search yields no good results.</p>
  
  <p>I did find a recent chrome development blog implying that CORS support was wide spread in modern browsers but might break because of WebGL security problems.<br>
  <a href="http://blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html">http://blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html</a></p>
  
  <p><strong>More detail on CORS:</strong></p>
  
  <p>We're considering the viability of using canvas &amp; CORS with cross domain image requests as described in the W3C Working Draft <a href="http://www.w3.org/TR/cors/#use-cases">http://www.w3.org/TR/cors/#use-cases</a>. CORS is used by html canvas to allow cross domain resource usage in a fashion similar to the way flash uses crossdomain.xml. Basically, we want to read/edit the image data pixels and we don't want to use a same origin proxy server. </p>
  
  <p>Normally, if are images loaded cross domain and used with html canvas, accessing pixels using functions like canvas.toDataURL() will throw a security error. However, If the server delivering the image adds a header like this, the cross domain usage should be allowed.</p>
  
  <pre><code>access-control-allow-origin: *
  </code></pre>
  
  <p><strong>Browsers We Care Most About:</strong></p>
  
  <p>We are planning to work around IE's lack of canvas support using flash, so for desktop browsers with a CORS problem we can do that as well, but on mobile flash is not an option, and using a proxy to make the requests same origin is not an option in our use case.  So, I'm particularly interested in Andriod, Iphone, IPAD browser support for CORS. </p>