# Cross-Origin-Resource-Policy Header — Values & Examples

> Says which sites may load this resource through plain tags like <img> and <script>.

Tags like `<img>` and `<script>` load cross-origin resources without CORS. CORP lets a server refuse that, limiting side-channel attacks such as Spectre that read data through embedded resources. It also matters in the other direction: a page using `Cross-Origin-Embedder-Policy: require-corp` can only load your files if they send `Cross-Origin-Resource-Policy: cross-origin` or CORS headers.

- Type: Response header
- Category: Security
- Defined in: [Fetch Standard — Cross-Origin-Resource-Policy](https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header)

## Syntax

```http
Cross-Origin-Resource-Policy: same-origin | same-site | cross-origin
```

## Values

| Value | Meaning |
|---|---|
| `same-origin` | only pages on the same origin may load it |
| `same-site` | any page on the same site, subdomains included |
| `cross-origin` | any site may load it |

## Examples

```http
Cross-Origin-Resource-Policy: same-origin
```

private files and API responses

```http
Cross-Origin-Resource-Policy: cross-origin
```

public CDN assets meant to be embedded anywhere

## Good to know

- CORP only applies to no-cors requests; CORS requests are governed by `Access-Control-Allow-Origin`.
- Public CDNs and image hosts should send `cross-origin` so cross-origin-isolated pages can use them.

## How to set Cross-Origin-Resource-Policy

### Express

```
res.set("Cross-Origin-Resource-Policy", "same-origin");
```

### Next.js (next.config.js)

```
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Cross-Origin-Resource-Policy", value: "same-origin" }],
      },
    ];
  },
};
```

### nginx

```
add_header Cross-Origin-Resource-Policy "same-origin" always;
```

### Apache (.htaccess)

```
Header always set Cross-Origin-Resource-Policy "same-origin"
```

## Check it

Fetch only the response headers and filter for Cross-Origin-Resource-Policy. In the browser, it's under Response Headers in DevTools → Network.

```sh
curl -sI https://example.com/ | grep -i '^cross-origin-resource-policy:'
```

## FAQ

### Why is my image blocked with ERR_BLOCKED_BY_RESPONSE.NotSameOriginAfterDefaultedToSameOriginByCoep?

The page uses COEP require-corp and the image's server sends neither CORP nor CORS headers. Add Cross-Origin-Resource-Policy: cross-origin on the image host, or switch the page to COEP credentialless.

## Related headers

- [Cross-Origin-Embedder-Policy](https://www.devkult.com/headers/cross-origin-embedder-policy.md): Requires the resources a page loads to opt in to being embedded — the second half of cross-origin isolation.
- [Cross-Origin-Opener-Policy](https://www.devkult.com/headers/cross-origin-opener-policy.md): Isolates your page from cross-origin windows that open it or that it opens.
- [Access-Control-Allow-Origin](https://www.devkult.com/headers/access-control-allow-origin.md): Tells the browser which origin may read this response from JavaScript running on another site.

Open the interactive page: https://www.devkult.com/headers/cross-origin-resource-policy