让 javascript 访问外部图像有什么安全风险？
使用 JavaScript 无法将图像（托管在与 JavaScript 来源不同的域中）转换为画布。
这有什么安全风险？不能只是为了避免网络钓鱼，对吧？
Using javascript one cannot convert an image (hosted on a different domain than the one the javascript comes from) into a canvas.
What's the security risk with that? It can't just be to avoid phishing, right?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
同源策略阻止其他域访问任何远程数据。此方法阻止的主要攻击之一是能够通过等待用户登录到另一个站点来绕过用户登录，然后在其经过身份验证的会话上附带您的请求。
无论加载的数据是 HTML 片段、图像文件还是其他任何内容，它都会被阻止，因此您无法以任何方式利用（例如，通过检查以这种方式检索的图像的像素数据）
Same origin policy stops any remote data from being accessible by a different domain. One of the main attacks this stops is being able to circumvent a user's login by waiting for them to be logged into another site, and then piggy-back your request on their authenticated session.
Whether the data loaded is an HTML snippet, an image file or anything else, it's blocked so you can't take advantage in any way (for example, by inspecting the pixel data of an image retrieved this way)
有一种与外部图像相关的棘手攻击媒介：有人可以发布将从他们控制的外部资源加载的图像。一段时间后，可以更改此 url 以返回基本 http 身份验证的请求。因此其他用户将看到请求其登录名和密码的窗口。一些用户，尤其是没有经验的用户可以输入攻击资源的凭据，该凭据将发送给攻击者。所以要小心外部资源。
There is one tricky attack vector connected with external images: someone can post image which will be loaded from the external resource, which they control. After some time this url can be changed to return the request for the basic http authentication. So the other users will see windows requesting their login and password. Some users, especially non-experienced ones can enter the credentials of the attacking resources which will be sent to the attacker. So be careful with external resources.