Cross-Origin-Resource-Policy
response headersecurity
Says which sites may load this resource through plain tags like <img> and <script>.
Tags like <img> and <script> load cross-origin resources without CORS. CORP lets a server refuse that, limiting side-channel attacks such as Spectre that read data through embedded resources. It also matters in the other direction: a page using Cross-Origin-Embedder-Policy: require-corp can only load your files if they send Cross-Origin-Resource-Policy: cross-origin or CORS headers.
Syntax
Cross-Origin-Resource-Policy: same-origin | same-site | cross-origin
Defined in Fetch Standard — Cross-Origin-Resource-Policy.
Values
| same-origin | only pages on the same origin may load it |
|---|---|
| same-site | any page on the same site, subdomains included |
| cross-origin | any site may load it |
Examples
Cross-Origin-Resource-Policy: same-origin
private files and API responses
Cross-Origin-Resource-Policy: cross-origin
public CDN assets meant to be embedded anywhere
Good to know
- CORP only applies to no-cors requests; CORS requests are governed by
Access-Control-Allow-Origin. - Public CDNs and image hosts should send
cross-originso cross-origin-isolated pages can use them.
How to set Cross-Origin-Resource-Policy
res.set("Cross-Origin-Resource-Policy", "same-origin");module.exports = {
async headers() {
return [
{
source: "/(.*)",
headers: [{ key: "Cross-Origin-Resource-Policy", value: "same-origin" }],
},
];
},
};add_header Cross-Origin-Resource-Policy "same-origin" always;
Header always set Cross-Origin-Resource-Policy "same-origin"
Check it
Fetch only the response headers and filter for Cross-Origin-Resource-Policy. In the browser, it's under Response Headers in DevTools → Network.
curl -sI https://example.com/ | grep -i '^cross-origin-resource-policy:'
To compare response headers across many URLs at once, use the HTTP Status Checker.
Frequently asked questions
Why is my image blocked with ERR_BLOCKED_BY_RESPONSE.NotSameOriginAfterDefaultedToSameOriginByCoep?
The page uses COEP require-corp and the image's server sends neither CORP nor CORS headers. Add Cross-Origin-Resource-Policy: cross-origin on the image host, or switch the page to COEP credentialless.