Cross-Origin Resource Policy

“Cross-Origin-Resource-Policy” response header allows http servers to ask the browser to prevent cross-origin or cross-site embedding of the returned resource. It is complementary to the Cross-Origin Read Blocking feature and is especially valuable for resources not covered by CORB (which only protects HTML, XML and JSON). “Cross-Origin-Resource-Policy” is currently the only way to protect images against Spectre attacks or against compromised renderers.

Specification

Established standard

Status in Chromium

Blink components: Blink>SecurityFeature

Enabled by default (tracking bug) in:

Chrome for desktop release 73
Chrome for Android release 73
Android WebView release 73

Consensus & Standardization

After a feature ships in Chrome, the values listed here are not guaranteed to be up to date.

Firefox: Public support
Edge: No public signals
Safari: Shipped
Web Developers: Positive

Owners

lukasza@chromium.org
creis@chromium.org

Last updated on 2019-01-29