Files
wordpress/wp-includes
Adam Silverstein f873449293 Media: Remove IMG from crossorigin attribute injection.
Under `Document-Isolation-Policy: isolate-and-credentialless`, the browser's credentialless mode already handles cross-origin image loading without requiring CORS headers. Explicitly adding `crossorigin="anonymous"` to `<img>` elements overrides this behavior and forces a CORS preflight request, breaking images from servers that don't include `Access-Control-Allow-Origin` in their response headers.

This also removes the related `imagesrcset` handling from `LINK` elements, which had the same issue for `<link>` preload tags for images.

See related Gutenberg issue: https://github.com/WordPress/gutenberg/issues/76476.

Follow-up to [61844], [61846].

Props adamsilverstein, swissspidy.
Fixes #64886.

Built from https://develop.svn.wordpress.org/trunk@62048


git-svn-id: http://core.svn.wordpress.org/trunk@61330 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2026-03-19 00:11:48 +00:00
..
2026-03-05 11:58:29 +00:00
2026-02-20 08:42:48 +00:00