Cross-Origin-Resource-Policy Header: Syntax and Examples

How Cross-Origin-Resource-Policy works

It protects resources such as images or JSON from being pulled into other sites’ pages, which matters for side-channel attacks like Spectre. CDNs and public assets that are meant to be embedded by COEP-isolated pages must send cross-origin.

Directives

Value	Meaning
`same-origin`	Only your exact origin may load it.
`same-site`	Any subdomain of your site may load it.
`cross-origin`	Anyone may load it. Needed for embedding in cross-origin isolated pages.

Examples

Public CDN asset

Cross-Origin-Resource-Policy: cross-origin

Check it

curl -sI https://example.com | grep -i '^cross-origin-resource-policy:'

Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.

Related headers

Cross-Origin-Embedder-Policy: requires every cross-origin resource a page loads to opt in to being embedded (COEP).
Cross-Origin-Opener-Policy: separates your page from cross-origin windows it opens or is opened by (COOP).
X-Content-Type-Options: stops browsers from guessing (“sniffing”) a response’s type instead of trusting Content-Type.

More security headers

Content-Security-Policy , Strict-Transport-Security , X-Frame-Options , Referrer-Policy , Permissions-Policy .

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does the Cross-Origin-Resource-Policy header do?

The Cross-Origin-Resource-Policy response header says which sites may load this resource with no-cors requests such as <img> and <script> (CORP). It protects resources such as images or JSON from being pulled into other sites’ pages, which matters for side-channel attacks like Spectre. CDNs and public assets that are meant to be embedded by COEP-isolated pages must send cross-origin.

How do I see the Cross-Origin-Resource-Policy header?

Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.