Cross-Origin-Resource-Policy
ResponseActiveCross-Origin-Resource-Policy (CORP) controls which origins can load a resource via no-cors requests – <img>, <script>, <link>, CSS url(). 'same-site' restricts to same-site origins. 'same-origin' restricts to exact same origin. 'cross-origin' allows any origin. CORP is required for subresources to be loaded by pages with Cross-Origin-Embedder-Policy: require-corp.
Description
CORP protects resources from Spectre-style cross-origin reads. A resource loaded via no-cors (most images, scripts, stylesheets) can be read into an ArrayBuffer by a compromised renderer process without CORP. CORP: same-origin prevents other origins from loading the resource at all. Required for COEP compliance: any resource loaded by a COEP: require-corp page must either have CORS headers or CORP: cross-origin.
Directives
| Directive | Description |
|---|---|
| same-origin | Only the same origin can load this resource. |
| same-site | Only the same registrable domain can load this resource. |
| cross-origin | Any origin can load this resource. Required for COEP: require-corp subresources. |
Examples
Cross-Origin-Resource-Policy: same-originCross-Origin-Resource-Policy: cross-origin