The HTTP Cross-Origin-Resource-Policy response header conveys a desire that the browser blocks no-cors cross-origin/cross-site requests to the given resource.
| Header type | Response header |
|---|---|
| Forbidden header name | no |
The HTTP Cross-Origin-Resource-Policy response header conveys a desire that the browser blocks no-cors cross-origin/cross-site requests to the given resource.
| Header type | Response header |
|---|---|
| Forbidden header name | no |
Cross-Origin-Resource-Policy: same-site | same-origin | cross-origin
The response header below will cause compatible user agents to disallow cross-origin no-cors requests:
Cross-Origin-Resource-Policy: same-origin
For more examples, see https://resourcepolicy.fyi/.
| Specification |
|---|
| Fetch Standard # cross-origin-resource-policy-header |
| Desktop | Mobile | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Chrome | Edge | Firefox | Internet Explorer | Opera | Safari | WebView Android | Chrome Android | Firefox for Android | Opera Android | Safari on IOS | Samsung Internet | |
Cross-Origin-Resource-Policy |
73
["Until version 75, downloads for files with this header would fail in Chrome. See bug 952834.", "From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See bug 1074261. From version 86, partial PDF loading is disabled."]
|
79 |
74 |
No |
No |
12 |
73
["Until version 75, downloads for files with this header would fail in Chrome. See bug 952834.", "From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See bug 1074261. From version 86, partial PDF loading is disabled."]
|
73
["Until version 75, downloads for files with this header would fail in Chrome. See bug 952834.", "From version 80 to 85, linearized PDFs served inline with this header fail to render properly. See bug 1074261. From version 86, partial PDF loading is disabled."]
|
No |
No |
12 |
11.0 |
© 2005–2022 MDN contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy