If I have a script
tag with a cross-domain src
and I want to access errors from window.onerror
, I need to add the crossorigin
attribute:
<script type="text/javascript" src="otherdomain.com/foo.js" crossorigin="..."></script>
My question is, what should the attribute's value be? Does it matter? Does it even need a value?
I've seen a few people using the value "anonymous"
, but I can't find a proper explanation as to why. This blog post notes mysteriously that it is the "most secure value".