Cross-Origin-Resource-Policy

The HTTP Cross-Origin-Resource-Policy response header conveys a desire that the browser blocks no-cors cross-origin/cross-site requests to the given resource.

Header type	Response header
Forbidden header name	no

Syntax

Cross-Origin-Resource-Policy: same-site | same-origin | cross-site

Examples

The response header below will cause compatible user agents to disallow cross-origin no-cors requests:

Cross-Origin-Resource-Policy: same-origin

Specifications

Specification	Status	Comment
Fetch	Living Standard	Initial definition

Browser compatibility

Update compatibility data on GitHub

	Desktop						Mobile
	Chrome	Edge	Firefox	Internet Explorer	Opera	Safari	Android webview	Chrome for Android	Firefox for Android	Opera for Android	Safari on iOS	Samsung Internet
`Cross-Origin-Resource-Policy`	Chrome Full support 73 Notes Full support 73 Notes Notes Until version 75, downloads for files with this header would fail in Chrome. See bug 952834.	Edge No support No	Firefox Full support 69 Disabled Full support 69 Disabled Disabled From version 69: this feature is behind the `browser.tabs.remote.useCORP` preference (needs to be set to `true`). To change preferences in Firefox, visit about:config.	IE No support No	Opera No support No	Safari Full support 12	WebView Android Full support 73 Notes Full support 73 Notes Notes Until version 75, downloads for files with this header would fail in WebView. See bug 952834.	Chrome Android Full support 73 Notes Full support 73 Notes Notes Until version 75, downloads for files with this header would fail in Chrome. See bug 952834.	Firefox Android No support No	Opera Android No support No	Safari iOS Full support 12	Samsung Internet Android No support No

Legend

Full support: Full support
No support: No support
See implementation notes.: See implementation notes.
User must explicitly enable this feature.: User must explicitly enable this feature.