I'm trying to motivate the reason why Same-Origin Policy allows cross-site request for image to setCookie?
This is my understand, say I build a website A.com.
-
motivation of sending a cross-site request: images takes space, so I use image by embedding from other(cross-site) sites.
-
motivation of sending image request with cookie: I know some private image should be retrieved only by logined users. However, is there a reason why a cross-site website should embedded such private image?
I can't figure it out, can someone help?