HTTP headers | Cross-Origin-Resource-Policy

The Cross-Origin-Resource-Policy is an HTTP response-type header that allows the servers to protect against certain cross-origin or cross-site embedding of the returned source. It complements the Cross-Origin Read Blocking (A mechanism which is used to prevent some cross-origin reads), so it is especially valuable for resources that are not covered by CORB. This also serves as an additional layer to the Same-Origin Policy. This helps in mitigating speculative side-channel attacks as well as Cross-Site Script Inclusion attacks.
The Cross Origin Resource Policy is the only way to protect the images from Spectre attacks or compromised renderers.

However, because of a chrome bug, this response header can sometimes break file downloads and prevent the users from using Save as and Save image as on the resources.

Syntax:

Cross-Origin-Resource-Policy: same-site | same-origin | cross-site

Directives: This header accepts three directives as mentioned above and describes below:

• same-site: This directive allowed users to read the resources only when the browser recognizes their requests from the same site (registrable domain).
• same-origin: This directive allowed users to read the resources only when the browser recognizes their requests from the same origin ([scheme, host, port]).
• cross-site: This directive allowed users requests from different sites can also read the resources.

Note: If a header is set during the Cross-origin resource check, then the browser will automatically deny all the no-cors requests issued by different origin or site.

Below examples illustrate the HTTP Cross-Origin-Resource-Policy:

Examples:

• In the example below, only the requests that the browser recognizes as from the same site are allowed to read the resources.

  Cross-Origin-Resource-Policy: same-site

• In the below example, only the requests that the browser recognizes as from the same origin are allowed to read the resources.

  Cross-Origin-Resource-Policy: same-origin

Supported Browsers: The browsers are compatible with the HTTP Cross-Origin-Resources-Policy are listed below:

• Google Chrome
• Firefox
• Safari

My Personal Notes arrow_drop_up

Save