Note: Due to a bug in Chrome, setting Cross-Origin-Resource-Policy can break PDF rendering, preventing visitors from being able to read past the first page of some PDFs. Due to a bug in Firefox, setting Cross-Origin-Resource-Policy can prevent some resources (such as PDFs) from being downloaded in some circumstances. Exercise caution using this header in a production environment.
The HTTP Cross-Origin-Resource-Policy response header conveys a desire that the browser blocks no-cors cross-origin/cross-site requests to the given resource.
| Header type | Response header |
|---|---|
| Forbidden header name | no |
Syntax
Cross-Origin-Resource-Policy: same-site | same-origin | cross-origin
Examples
The response header below will cause compatible user agents to disallow cross-origin no-cors requests:
Cross-Origin-Resource-Policy: same-origin
For more examples, see https://resourcepolicy.fyi/.
Specifications
| Specification | Status | Comment |
|---|---|---|
| Fetch | Living Standard | Initial definition |
Browser compatibility
The compatibility table on this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
Update compatibility data on GitHub
| Desktop | Mobile | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
Cross-Origin-Resource-Policy | Chrome
Full support
73
| Edge Full support 79 | Firefox
Full support
74
| IE No support No | Opera No support No | Safari Full support 12 | WebView Android
Full support
73
| Chrome Android
Full support
73
| Firefox Android No support No | Opera Android No support No | Safari iOS Full support 12 | Samsung Internet Android No support No |
Legend
- Full support
- Full support
- No support
- No support
- See implementation notes.
- See implementation notes.
- User must explicitly enable this feature.
- User must explicitly enable this feature.