Cross-Origin-Resource-Policy

Note: Due to a bug in Chrome, setting Cross-Origin-Resource-Policy can break PDF rendering, preventing visitors from being able to read past the first page of some PDFs. Due to a bug in Firefox, setting Cross-Origin-Resource-Policy can prevent some resources (such as PDFs) from being downloaded in some circumstances. Exercise caution using this header in a production environment.

The HTTP Cross-Origin-Resource-Policy response header conveys a desire that the browser blocks no-cors cross-origin/cross-site requests to the given resource.

Header type Response header
Forbidden header name no

Syntax

Cross-Origin-Resource-Policy: same-site | same-origin | cross-origin

Examples

The response header below will cause compatible user agents to disallow cross-origin no-cors requests:

Cross-Origin-Resource-Policy: same-origin

For more examples, see https://resourcepolicy.fyi/.

Specifications

Specification Status Comment
Fetch Living Standard Initial definition

Browser compatibility

DesktopMobile
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidFirefox for AndroidOpera for AndroidSafari on iOSSamsung Internet
Cross-Origin-Resource-PolicyChrome Full support 73
Notes
Full support 73
Notes
Notes Until version 75, downloads for files with this header would fail in Chrome. See bug 952834.
Notes From version 80, linearized PDFs served inline with this header fail to render properly. See bug 1074261.
Edge Full support 79Firefox Full support 74
Full support 74
Full support 69
Disabled
Disabled From version 69: this feature is behind the browser.tabs.remote.useCORP preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera No support NoSafari Full support 12WebView Android Full support 73
Notes
Full support 73
Notes
Notes Until version 75, downloads for files with this header would fail in WebView. See bug 952834.
Notes From version 80, linearized PDFs served inline with this header fail to render properly. See bug 1074261.
Chrome Android Full support 73
Notes
Full support 73
Notes
Notes Until version 75, downloads for files with this header would fail in Chrome. See bug 952834.
Notes From version 80, linearized PDFs served inline with this header fail to render properly. See bug 1074261.
Firefox Android No support NoOpera Android No support NoSafari iOS Full support 12Samsung Internet Android No support No

Legend

Full support
Full support
No support
No support
See implementation notes.
See implementation notes.
User must explicitly enable this feature.
User must explicitly enable this feature.

See also