CORS Test Page

This page is served from http://localhost:8082.
The MJPEG stream is at http://localhost:8080.
Because the ports differ, these are different origins — the browser enforces CORS.

Test 1: <img> tag (works — no CORS restriction)

Browsers allow cross-origin images in <img> tags. The stream loads, but JavaScript cannot read the pixels.

Test 2: fetch() — CORS blocked

A fetch() to the MJPEG server will be blocked by the browser because the server does not send Access-Control-Allow-Origin.

Not tested yet

    
  


  
  

    
Test 3: Canvas drawImage — tainted canvas

    
Even though the <img> loads, drawing it on a canvas and
       calling getImageData() throws a SecurityError
       (tainted canvas).

    
    
Not tested yet

    

    
  


  
  

    
Test 4: XMLHttpRequest — CORS blocked

    
Same as fetch, but using the older XMLHttpRequest API.

    
Not tested yet

    

    
  


  

  
Mitigations


  
  

    
Mitigation A: Server adds CORS headers

    
The MJPEG server exposes /cors/stream.mjpg which returns
       Access-Control-Allow-Origin: *. Same cross-origin request,
       but now the browser allows it.

    
Not tested yet

    

    
  


  
  

    
Mitigation B: Reverse proxy (same origin)

    
This site's nginx proxies /proxy/stream.mjpg to the MJPEG server.
       The browser sees it as same-origin — no CORS at all.

    

    
Not tested yet