“Cross-Origin-Resource-Policy” response header allows http servers to ask the browser to prevent cross-origin or cross-site embedding of the returned resource. It is complementary to the Cross-Origin Read Blocking feature and is especially valuable for resources not covered by CORB (which only protects HTML, XML and JSON). “Cross-Origin-Resource-Policy” is currently the only way to protect images against Spectre attacks or against compromised renderers.
Specification
Status in Chromium
Enabled by default (tracking bug) in:
- Chrome for desktop release 73
- Chrome for Android release 73
- Android WebView release 73
Consensus & Standardization
After a feature ships in Chrome, the values listed here are not guaranteed to be up to date.
- Positive
- No signal
- Shipped/Shipping
- Positive
Owners
Search tags
corp, from-origin, cross-origin-resource-policy,Last updated on 2020-11-09