“Cross-Origin Resource Sharing Policy” Between Subdomains In JS?

I have a Tumblr theme that includes a canvas script. The Cross-Origin Resource Sharing policy doesn't allow context.getImageData() to work. Script is located at user.tumblr.com,

Solution 1:

document.domain will be your friend there.

I haven't studied the canvas security model closely, but if it follows the rest of Javascript, setting

document.domain = tumblr.com

might help.

(Googling for document.domain canvas may lead to more.)