title: Why can't I force download of tainted canvas and why is it a security issue?
body: <p>Why can't I force download of tainted canvas and why is it a security issue?</p>
  
  <p>Take this example situation: On example.com (example of my domain) I can download a JSON file and read it.</p>
  
  <p>I can load an image with a src from example.org (example of someone else's domain). I can draw that image to a canvas(at which point it becomes tainted), and I can still draw on top of that canvas.</p>
  
  <p>A visitor to my page can right click on that canvas and save image as.</p>
  
  <p>Is the taint just to stop the image data getting into the JavaScript?</p>
  
  <p>Why is it OK for data (JSON) and not OK for images?</p>
  
  <p>In JavaScript I can automatically start a download of a canvas by converting to data URL, making a link element and making the JavaScript click it.</p>
  
  <p>Is there a way to achieve the same result without a "security issue", I want to automatically download the canvas just like if the user had right click "save image as" I don't need the image data in the JavaScript. As it just draws a diagram on top of a canvas that has been tainted by a base image from another domain.</p>