If I create a simple web page with just a body and an image, for example:
<!doctype html>
<html>
<head>
</head>
<body>
<img id="image" src=https://knowpathology.com.au/wp-content/uploads/2018/07/happy-test-screen.jpg alt="" width="400" height="400">
</body>
</html>
It loads fine even though the src is from a cross-origin (not the original domain that served the page). Is this supposed to happen? I thought that’s what the crossorigin attribute was for. I’ve searched for info and all I can find is explanation telling that cross-origin is disabled by default, then why does this work?