crossorigin anonymous/use-credentials Table
Resolves a CORS settings attribute and potential-CORS request credentials mode for img/media without the same-origin fallback flag. Missing attribute means no-cors/include; empty or invalid present values mean cors/same-origin. Always-CORS features use a different mapping.
Description
A CORS settings attribute affects request mode and credentials for image/media potential-CORS requests.
Cross-origin resource sharing (CORS) lets a server permit access to a response from a different origin. The crossorigin attribute affects request mode and credentials for image/media potential-CORS requests. Omission differs from an empty attribute, which selects anonymous CORS.1
The tool returns state, requestMode, credentialsMode. The fields describe the supplied local pattern or effective state, or contain the formatted markup shown below.
When to use crossorigin anonymous/use-credentials Table
Use this to explain the request and credentials modes of an image or media crossorigin attribute, especially the difference between an omitted attribute, an empty value and use-credentials.
How to use crossorigin anonymous/use-credentials Table and understand its results
- Prepare the parsed element names, attribute values or direct element-child lists requested below. Keep attribute presence separate from its value.
- Enter present, value according to the field table, then run the tool.
- Read state, requestMode, credentialsMode. Check the effective state, recognized-token flags or generated markup against the rules below.
- Correct any reported local mismatch and check the resulting markup in its intended document and browser context.
| Input field | Meaning | Value type and bounds | Requirement |
|---|---|---|---|
| present | Present | boolean | Required |
| value | Value | string; maximum text length 100000 | Required |
Supply presence and value. Fold ASCII case, resolve no-cors, use-credentials or anonymous, and map that state to requestMode and credentialsMode.
absent → no-cors/include; use-credentials → cors/include; other present values → cors/same-origin The symbols and boundary conditions refer to the supplied fields and the implementation described above.
| Output field | Meaning | Value type |
|---|---|---|
| state | State | string |
| requestMode | Request Mode | string |
| credentialsMode | Credentials Mode | string |
{
"input": {
"present": true,
"value": ""
},
"output": {
"state": "anonymous",
"requestMode": "cors",
"credentialsMode": "same-origin"
}
}Limitations and assumptions
This profile excludes the same-origin fallback flag and always-CORS features. It does not send a request, check server headers or guarantee resource or canvas access.
The tool does not fetch a page, run a browser or validate an entire HTML document. Malformed tool requests produce input errors; valid requests can still report unrecognized values or failed local checks.
Alternative or Complementary methods
Choose referrerpolicy Values Table when you need its operation: Resolves a referrerpolicy attribute to its standard keyword or the empty inherited-policy state. It does not compute referrer URLs or combine document headers and noreferrer. Choose iframe sandbox Token List Lookup for the complementary operation: Classifies standard iframe sandbox tokens and resolves the scripts and origin restrictions imposed by this attribute alone. Omitted sandbox differs from an empty sandbox; inherited and CSP restrictions are outside this check.
Background reference: HTML Standard: crossorigin anonymous/use-credentials Table.
References
Similar or alternative tools
- referrerpolicy Values Table
Resolves a referrerpolicy attribute to its standard keyword or the empty inherited-policy state. It does not compute referrer URLs or combine document headers and noreferrer.
- iframe sandbox Token List Lookup
Classifies standard iframe sandbox tokens and resolves the scripts and origin restrictions imposed by this attribute alone. Omitted sandbox differs from an empty sandbox; inherited and CSP restrictions are outside this check.