HTTP security header

Cross-Origin-Resource-Policy

Cross-Origin-Resource-Policy (CORP) lets a resource declare that only same-origin or same-site documents may load it, helping defend against cross-origin information leaks such as Spectre-style side channels and unauthorized embedding.

Example

Cross-Origin-Resource-Policy: same-origin

Configuration guidance

Use same-origin or same-site for sensitive resources.
Combine with COOP and COEP for cross-origin isolation.

Related headers

Cross-Origin-Opener-Policy
Content-Security-Policy

MDN: CORP

Impactr finds and proves whether flaws like this are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.

Start an engagement

← All security headers