Headers: Cross-Origin-Resource-Policy

Cross-Origin-Resource-Policy (CORP) header

The HTTP Cross-Origin-Resource-Policy response header (CORP) indicates that the browser should block no-cors cross-origin or cross-site requests to the given resource.

It specifies resource owner's policy for what sites/origins should be allowed to load this resource.

Header type	Response header

Syntax

Cross-Origin-Resource-Policy: same-site | same-origin | cross-origin

Directives

same-site: Resources can only be loaded from the same site.
same-origin: Resources can only be loaded from the same origin.
cross-origin: Resources can be loaded by any other origin/website.

Examples

For more examples, see https://resourcepolicy.fyi/.

Disallowing cross-origin no-cors requests

The Cross-Origin-Resource-Policy header below will cause compatible user agents to disallow cross-origin no-cors requests:

Cross-Origin-Resource-Policy: same-origin

Specifications

Specification
Fetch> # cross-origin-resource-policy-header>

Browser compatibility

	Desktop					Mobile
	Chrome	Edge	Firefox	Opera	Safari	Chrome Android	Firefox for Android	Opera Android	Safari on IOS	Samsung Internet	WebView Android	WebView on iOS
`Cross-Origin-Resource-Policy`	73 ["Until version 75, downloads for files with this header would fail in Chrome. See bug 41452948.", "From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See bug 40127935. From version 86, partial PDF loading is disabled."]	79	74	60 ["Until version 62, downloads for files with this header would fail in Opera. See bug 41452948.", "From version 67 to 85, linearized PDFs served inline with this header fail to render properly. See bug 40127935. From version 72, partial PDF loading is disabled."]	12	73 ["Until version 75, downloads for files with this header would fail in Chrome Android. See bug 41452948.", "From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See bug 40127935. From version 86, partial PDF loading is disabled."]	79	52 ["Until version 54, downloads for files with this header would fail in Opera Android. See bug 41452948.", "From version 57 to 85, linearized PDFs served inline with this header fail to render properly. See bug 40127935. From version 61, partial PDF loading is disabled."]	12	11.0	73 ["Until version 75, downloads for files with this header would fail in WebView Android. See bug 41452948.", "From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See bug 40127935. From version 86, partial PDF loading is disabled."]	12