I just added support for <link rel="stylesheet" crossorigin> in
Gecko.[1] Such links are subject to CORS checks if the load is
cross-site, and the sheet load will fail if the CORS check fails. If
the CORS check succeeds, script in the page will be able to script the
cross-site stylesheet.
This allows stylesheets served from a CDN to be scripted by the page if
desired, so I would like to propose that we add this feature to the spec.
An open issue: what to do about @import? I haven't done anything magic
here yet. Inheriting the CORS mode from the importing sheet is a bit
weird, and I wasn't quite sure I wanted to make CSS syntax changes at
this time.
-Boris
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=732209
