Cross-Origin-Resource-Policy
Declares which origins are allowed to load your resources, protecting against cross-origin information leaks like Spectre-style side channels.
What it does
Cross-Origin-Resource-Policy (CORP) lets a resource, an image, script, or API response, declare which origins may load it. Browsers enforce this at the network level, blocking the load client-side if the requesting origin isn't permitted.
Why it matters
Even resources that don't contain sensitive data directly can leak information through timing and size side channels when loaded cross-origin (for example, whether a private image exists at all). CORP prevents other sites from embedding your resources without permission, and is also the counterpart header that lets your resources be embedded by pages using a strict Cross-Origin-Embedder-Policy.
Recommended value
same-origin: strictest; only the exact same scheme+host+port may load the resource.same-site: allows your own subdomains, a reasonable default for most applications.cross-origin: explicitly opts in to being loaded by anyone, needed for public assets like fonts or a CDN meant for embedding elsewhere.