Skip to content
iframecheck

Cross-Origin-Resource-Policy

Cross-Origin-Resource-Policy (CORP) is an HTTP response header that a resource sends to limit who may load it. The browser blocks a no-cors load from a page that the value does not allow.

HTTP header

Also called CORP

Updated

On this page

How it works

CORP goes on the resource, not on the page that loads it. It applies to no-cors requests, such as an <img> or a <script> without the crossorigin attribute. A request in cors mode uses CORS rules instead.

For frames, the browser checks CORP only when the parent page sends COEP require-corp or credentialless. Then a cross-origin page needs a CORP value that allows the parent, for example cross-origin. Without COEP on the parent, CORP has no effect on frames.

Values

ValueWho can load the resource
same-originOnly pages on the same origin.
same-siteOnly pages on the same site. An HTTPS resource does not match an HTTP page.
cross-originPages on any origin.

The values are case-sensitive. The browser treats an unknown value, or two CORP headers, as no header.

Example

HTTP response header
Cross-Origin-Resource-Policy: same-site

If this header is on https://cdn.example.com, pages on example.com and its subdomains can load the resource. Pages on other sites cannot.

How to set it

Send the header with the resource, such as an image, a script, or a page that goes in a frame. Pick the narrowest value that still lets your pages load it.

Cross-Origin-Resource-Policy: same-origin

CORP does not stop other sites from framing your page. Use CSP frame-ancestors for that.

Learn more

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.

Test a URLBrowse guides